Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Denotes security questions on Magento.

0
votes
2answers
39 views

Document root change help

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache. I did the ...
0
votes
1answer
24 views

Magento 2 recommended approach to applying patches

So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
1
vote
0answers
94 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
0
votes
0answers
8 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
2answers
172 views

Unableto verify site on Magento Security Scan

I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
3
votes
1answer
42 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
19
votes
7answers
6k views

Magento 2: “Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider”

My Magento 2 development environment has started poking me with the following error message Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact ...
3
votes
1answer
20 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
2
votes
1answer
3k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
4
votes
1answer
4k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
15
votes
14answers
5k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
1
vote
0answers
39 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
3
votes
1answer
267 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
1
vote
2answers
69 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
0
votes
0answers
20 views

Do I need to update to 2.3.1?

If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
24
votes
17answers
4k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
0
votes
1answer
83 views

Want to install SUPEE-11086 patch for magento 1.9.2.0 version

I want to install SUPEE-11086 patch Magento 1.9.2.0 version. Does anyone have an idea about this?
2
votes
1answer
35 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
0
votes
2answers
52 views

HTTPS security is compromised by http://www.mfeuk.co.uk/js/mt/widget/frontend.js

can anyone help with this, I'm not anywhere close to calling myself proficient in magento but can normally track most things by trial and error, I have the problem that on my checkout page I have ...
7
votes
5answers
8k views

How to apply the Magento 2 patches?

I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch. How can I apply the *.patch files?
0
votes
1answer
81 views

which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE

I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE. Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
31 views

Security problem: newsletter/subscribe has not been whitelisted

i have just move the my magento store to new hosting then im facing this issue In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
2
votes
2answers
4k views

Magento 1.9 CE security fixing end of life

I just read all answers from this question: Future Support of Magento 1.9 - Coming Magento 2.0 But I can't find a clear date or an official reference about the end of life date for Magento 1.9. Is ...
14
votes
15answers
8k views

Security Patch SUPEE-10752 - Possible issues?

A new security patch is out for Magento 1, addressing 25 APPSEC issues https://magento.com/security/patches/supee-10752 What common issues do you have to watch out for when applying this patch? ...
0
votes
0answers
18 views

Magento1 website Security patch installation by script then error show

Magento1 website Security patch installation by script and when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show: ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
25 views

Magento1 website Security patch installation by script

Magento1 my website i have installing following Security patch: Security patch 10975 Security patch 10415 Security patch 9767 Security patch 8788 Security patch 7405 but i want script in my root ...
3
votes
2answers
218 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
1
vote
0answers
119 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
0
votes
1answer
82 views

how to prevent xss attacks and sql injection in magento 2 [closed]

I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
2
votes
2answers
151 views

Failed Magento SUPEE 6482 Security Check (APPSEC-1030) with Version 1.9.3.7 CE

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled. However, we are ...
1
vote
1answer
523 views

Magento1 SUPEE-11086 Potential Issues? [duplicate]

The Description of the patch SUPEE-11086 is: SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), ...
6
votes
1answer
162 views

Critical Vulnerability in Magestore Store Locator extension [closed]

Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension There's been no patch released by the actual vendor - Magestore Does anyone know: What the ...
2
votes
1answer
781 views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
1
vote
0answers
54 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
4
votes
2answers
255 views

Database possibly compromised

I want to know if strangers have accessed the database. If so, I want to find out how they got access to the database. I found a strange trigger in the database (screenshot below).
0
votes
0answers
18 views

Security steps and permission to have for Magento2

I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
2
votes
1answer
30 views

Security Report - patch 8788

Patch 8788 is available for <= 1.9.2.4. I have 1.9.3.4. How can I fix the issues addressed?
1
vote
0answers
7 views

Creating custom 2FA provider

I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator). Anybody who can point me in the right direction? I have been working with ...
2
votes
1answer
136 views

is this a spam email or real

Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk> Sent Date : Wed, 26 Dec 2018 22:03:27 +0000 From : magento@gohost.sk Sender MailID : magento@gohost.sk Reply To : magento@gohost.sk To : ...
45
votes
16answers
11k views

Security Patch SUPEE-10570 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10570 SUPEE-10570, Magento Commerce 1....
37
votes
9answers
15k views

Security Patch SUPEE-10415 - Possible Issues?

New Magento 1 patch has been released, SUPEE-10415. This patch provides protection against several types of security-related issues Info page: https://magento.com/security/patches/supee-10415 ...
2
votes
2answers
194 views

Contact form hack

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)...
1
vote
2answers
2k views

Magento Payment Methods Not Showing - Shows a CC Form Instead

I have noticed a strange issue recently on the Magento checkout. The same thing occurs whether I am using the default onpage Magento checkout, or if I am using the lotusbreath onepage checkout ...
0
votes
3answers
979 views

Magento 2 Newsletter fake subscriptions

Easily with any email you can subscribe to Magento 2 newsletter. The only available control is to send confirmation email to provided address. If provided email address is not valid Magento ...
-1
votes
1answer
90 views

security patches [duplicate]

I have received some alerts regarding security patches. So can someone guide me on whether to install the security patches or not to install them or what else to do about these security patches?
5
votes
1answer
3k views

Anonymous Scripts found in “Miscellaneous Scripts” section magento admin panel

Recently i had found some scripts inserted into the Miscellaneous Scripts section in admin panel.This code is not inserted by me!! how does it happen? the script i found was given below. can anybody ...
1
vote
3answers
53 views

Is “seolink” a virus?

On my site there is a script after the body tag, both on frontend and adminhtml. I can't find where it is included: It adds links in the header. Has anyone seen this?
1
vote
2answers
115 views

Our Magento account was hacked; files deleted; hosting company is unable to restore

Magento 1.9.1 Porto theme Managed VPS from Hostforweb CentOS 7.x/WHM / Cpanel We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
3
votes
1answer
94 views

Do bound parameters get escaped using the Core/Resource model?

Consider the following example: $connection = Mage::getSingleton('core/resource')->getConnection('core_read'); $email_address = $_GET['email']; $sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
3
votes
1answer
1k views

Suddenly started using another logged in user's session - Magento 2

This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this. I was testing some features on my dev server while someone else was logged ...