Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2021-32758

Layout XML Arbitrary Code Fix

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.

CVSS 3.1 · 7.2 High EPSS 2.0% KEV · Not listed
Vendors
Openmage
Products
Openmage
CVE-2020-26295

CMS Editor code execution

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

CVSS 3.1 · 8.7 High EPSS 2.2% KEV · Not listed
Vendors
Openmage
Products
Openmage
CVE-2020-26285

Widget instances allows a hacker to inject an executable file on the server on OpenMage

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

CVSS 3.1 · 8.7 High EPSS 3.7% KEV · Not listed
Vendors
Openmage
Products
Openmage
CVE-2020-26252

Layout XML RCE Vulnerability in OpenMage

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.

CVSS 3.1 · 8.7 High EPSS 2.1% KEV · Not listed
Vendors
Openmage
Products
Openmage
CVE-2020-15151

Observable Timing Discrepancy in OpenMage LTS

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Magento Openmage
Products
Magento Openmage Long Term Support