CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37295 – Aimeos Core remote code execution in web server context
https://notcve.org/view.php?id=CVE-2024-37295
11 Jun 2024 — Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue. Aimeos es un framework de comercio electrónico de código abierto para tiendas online. A partir de la versión 2024.01.1 y antes de la versión 2024.04.5, un usuario con privilegios administrativ... • https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c • CWE-73: External Control of File Name or Path •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37294 – Aimeos denial of service vulnerability in SaaS and marketplace setups
https://notcve.org/view.php?id=CVE-2024-37294
11 Jun 2024 — Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch. Aimeos es un framework de comercio electrónico de código abierto para tiendas online. Todas las configuraciones de SaaS y de mercado que utilizan la versión de Aimeos de 2022/2023/2024 se ven afectad... • https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p • CWE-270: Privilege Context Switching Error •