Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2020-15244

RCE in Magento

In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.

CVSS 3.1 · 8 High EPSS 1.3% KEV · Not listed
Vendors
Openmage
Products
Magento
CVE-2020-15151

Observable Timing Discrepancy in OpenMage LTS

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Magento Openmage
Products
Magento Openmage Long Term Support