Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

Why does /soap not follow site X-FRAME header?

After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
0
votes
0answers
35 views

How to secure my website magento 2

I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so. Also i want advice from you concerning sécurity ...
0
votes
0answers
36 views

How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?

My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
0
votes
1answer
312 views

What is the data encryption / hashing key management method used in Magento 2

Like in the title. What is the data encryption / hashing key management method used in Magento 2? I found this question Encryption Method Used by Magento Enterprise, however, is the same method used ...
0
votes
1answer
290 views

Hide Magento Admin Url from outside world

We have a magento server up and running. The server had the default 'admin' url which was then changed to some random string for security purpose, which only our team knows. Now we also have an admin ...
0
votes
2answers
199 views

Unableto verify site on Magento Security Scan

I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
0
votes
0answers
545 views

Someone is accessing my downloader..What's in /downloader/index.php ? How can I disable it since I never plan to use Magento Connect? [duplicate]

I have a few Magento 1.9 sites running on the same VPS server. I noticed today that the load on the server was unusually high. When I went to investigate, I found out someone was accessing my ...
0
votes
0answers
243 views

Magento 2:User Permission via API Rest

I have a multi-store magento 2 installation where the stores are totally independent, from different companies. So, we have an integration with our ERP system in the company. Each user in our system ...
0
votes
1answer
89 views

Site Magento 1.7.2 is down for Malware reason

I cannot access the site in Chrome and Mozilla. In internet Explore it is OK. It shows me "Security error->The site ahead contains malware". When I try to open it. The site is melvinflex.com. Is there ...
0
votes
2answers
976 views

SUPEE-10266 cannot be applied to 1.9.3.2 [duplicate]

I am experiencing issues patching the new SUPEE 10266 on Magento 1.9.3.2 The files where the hunks start failing have not been modified by me. Anyone else experiencing the same issue or have managed ...
0
votes
2answers
141 views

SUPEE 8788 v2 install fails on Magento 1.9.0.1

I'm trying to install SUPEE 8788 v2 on Magento 1.9.0.1 and get the following error. Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted successfully. ...
0
votes
1answer
331 views

Magento Patch: 9767 after install admin show Invalid Form Key

I install the security patch: 9767 on Magento version 1.9.3.0 after that, all forms like admin login form, customer login form, cart etc all are working stop as well as admin show me error like ...
0
votes
2answers
38 views

Which is better Magento or a php custom build? [closed]

Am planing to run a business and i have two option to choose between Magento or Php custom build (both of them will have the same functionality) so am considering about STABILITY and about SECURITY. ...
0
votes
3answers
456 views

Is it a Trojan? What can I do?

A customer complained about trojan alert on my website, and after doing some reading, I checked the pages, and I found this code below on the System > Configuration > General > Design. <script ...
0
votes
1answer
251 views

6788 patch error

I applied 6788 patch to my magento 1.9.1.1 instance, while i applying patch it gets like this PATCH_SUPEE-6788_CE_1.9.1.1_v1-2015-10-26-11-45-55.sh: 14: PATCH_SUPEE-6788_CE_1.9.1.1_v1-2015-10-...
0
votes
2answers
169 views

New Zend Framework 1 Security Vulnerability. I use Sendgrid, am I safe?

I've been made aware of the Zend Framework 1 Security Vulnerability. I understand that an attack could happen and so I wanted to be secure. We don't send mails directly from our magento server, we ...
0
votes
1answer
165 views

1.9.2.3 8788 Security Patch Issues [duplicate]

I am having some issues with security patch SUPEE-8788 ON Magento version 1.9.2.3 I have looked in the applied patches and it only lists 7405. So when I have ran 8788 v2 I came across some errors: ...
0
votes
1answer
78 views

My Database may have been affected by Shoplift vulnerability (SUPEE-5344)

I am trying to see all worst case scenario. My one of the site may have been shoplifted. Now, I am in process of quarantine it first then start fresh site with fresh files. However, I do need ...
0
votes
0answers
99 views

SUPEE-1533, SUPEE-5344 Possible Problems?

I tried to install patches Magento SUPEE-1533, SUPEE-5344 CE 1.8.1 without ssh access direct file upload but after install there's error both backend and website became unaccesable so i replaced all ...
0
votes
1answer
1k views

Installing Magento 2.0.10 security fix throws syntax error

I installed the newest code base from Magento for the security update and now my site won't come up. When I look in the logs I see the following. PHP Parse error: syntax error, unexpected '.' in /...
0
votes
1answer
130 views

Failed to install PATCH_SUPEE-7616_CE_1.9.2.2-CE_1.8.0.0_v1-2016-01-20-03-08-56.sh for Magento 1.8.0.0

I am trying to install patch SUPEE-7616 but it's failed. I am getting error: Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted successfully. checking ...
0
votes
2answers
76 views

Magento 1.8.0.0 Failed install PATCH_SUPEE-7405_CE_1.8.0.0_v1-2016-01-20-04-48-23

I can't install patch PATCH_SUPEE-7405_CE_1.8.0.0_v1-2016-01-20-04-48-23 into project. Error with this file : checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/...
0
votes
1answer
847 views

Magento version 1.7.0.2 security patches update [duplicate]

I am using Magento version 1.7.0.2 .I have not upgraded it newer version.There are several security patches update notification in my admin notification panel. Which security patches do I need to ...
0
votes
1answer
36 views

Tool to verify magento missing patchs

I want to scan magento missing patches in my laravel 5.2 application. How can I do that?
0
votes
2answers
33 views

Magento extension Installer automatically Installed on the Site?

I have found some unknown "Package manager extension" installed on the site automatically. If I go to that Extension site I have found that non of there extension is installed on my site, then how ...
0
votes
2answers
52 views

Facing issue in installation of path SUPEE 7405

I have upload file in root directory of SUPEE-7405 patch file. Apply below mentioned code in this file https://www.samuraimarket.net/applypatch.php: <?php print("<PRE>"); ...
0
votes
1answer
349 views

Trouble optimizing Magento permissions reset script

Currently, when I want to reset Magento permissions to ensure security, I execute the following from the root of my Magento project (planning on moving it to ./shell). On Git #!/bin/bash #This is ...
0
votes
0answers
48 views

MageReport scan status Unknown after applying patch SUPEE-5344 successfully [duplicate]

I applied patch SUPEE-5344 successfully for my Magento 1.9.1.0 website. But when i go to MageReport and scan my site I still get status Unknown for Security patch 5344 (Shoplift)?
0
votes
1answer
161 views

site break after installing security patch 6788

we installed all security patches for 1.9.0.1 edition except 6788 patch. when we are trying to install 6788 through SSH , its not working. we downloaded the zip folder of this patch, and installed ...
0
votes
1answer
96 views

Patch SUPEE-6285 can't be applied/reverted successfully ver. 1.8.1.0 [duplicate]

I'm trying to apply the SUPEE-6285 security patch to my Magento installation. I'm getting the following message after running the patch using bash via SSH. Can anyone advise the next steps to ...
0
votes
0answers
30 views

How to ensure that our website is not vulnerable to the issue SUPEE-6482 after installing the patches? [duplicate]

I've installed the patch SUPEE-6482, but still appear a window like this: Whether it means the patch is not installed correctly? How to ensure that our website/Magento is secure from the patch issue? ...
0
votes
2answers
254 views

Patch (SUPEE-6285) 1 out of 1 hunk FAILED saving rejects cart.phtml

sh PATCH_SUPEE-6285_CE_1.9.1.1_v2-2015-07-08-08-07-43.sh PATCH_SUPEE-6285_CE_1.9.1.1_v2-2015-07-08-08-07-43.sh: 24: 127: not found PATCH_SUPEE-6285_CE_1.9.1.1_v2-2015-07-08-08-07-43.sh: 24: 127: not ...
0
votes
1answer
61 views

Just to confirm and share: how to apply for magento patch supee-5344 [duplicate]

I found a possible solution for those who have no SSH access, or having difficulties using sh command to apply for the patch: (community edition) With the successful update on the local machine, find ...
0
votes
1answer
26 views

Is this an attempt to mess with the shop?

when i check in backend, customers online, is see an ip address viewing the site with a url that is strange The url structure is: https://www.mydomain.com/nl/category/page.html but i see someone ...
0
votes
1answer
173 views

Fixing base_url in database, why? [duplicate]

I have to maintain a Magento 1.9 e-commerce website. I can see that URL is hard coded in database web/secure/base_url web/unsecure/base_url Why this is recommanded ? What could be unsecure to use {...
-1
votes
1answer
959 views

If i secure magmi will my scripts on the server still be able to access it?

I recently discovered that my magmi ui in magento is not secured. I found instructions on securing it but I need to ensure that my scripts can still access it when I secure it. Can anyone help me with ...
-1
votes
1answer
167 views

Sucuri - Outdated Magento 1.9.1.0

I have received a below mail from sucuri (Website Security) Outdated Software Found outdated Magento inside: ./app/Mage.php - Version: 1.9.1.0 - Please update asap. Please help need to Update ...
-1
votes
1answer
204 views

Magento Exploit - Buddys ID in my home page

I'm a new web developer hired in house and it's only my 3rd day on the job and I found what looks to be a Exploit. The script is this here, <div id="buddys" style="position:absolute;filter:alpha(...
-1
votes
1answer
90 views

security patches [duplicate]

I have received some alerts regarding security patches. So can someone guide me on whether to install the security patches or not to install them or what else to do about these security patches?
-1
votes
1answer
403 views

Magento ver. 1.9.1.1 There has been an error processing your request, but only on one area [duplicate]

I am new to Magento and not very technical so apologies. The majority of the website seems to be working well, but on one specific product it keeps bringing up the warning "There has been an error ...
-1
votes
2answers
595 views

Remote Code Execution Exploit solution on shared server

http://www.magentocommerce.com/knowledge-base/entry/security-add-handler I read about the issue today seems my server is vulnerable. So I applied patch. However, I cannot edit httpd.conf as I am on ...