Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
349 results · page 6 of 7
Nov 16, 2020In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link.CVE-2020-26225 · Websites & servers · PrestaShop · reported by GitHubHigh 8.7
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
- Product
- productcomments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows aCVE-2020-26224 · Websites & servers · PrestaShop · reported by GitHubHigh 7.5
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/..CVE-2020-9368 · Other software · Oleacorner · reported by MITREHigh 7.5
The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal.
- Product
- Olea Gift ON Order
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comintrinsec.com
Sep 24, 2020In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files.CVE-2020-15162 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location paramCVE-2020-15160 · Websites & servers · PrestaShop · reported by GitHubCritical 9.8
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 24, 2020In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form.CVE-2020-15161 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2020In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form.CVE-2020-15178 · Websites & servers · PrestaShop · reported by GitHubHigh 8
In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.
- Product
- contactform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2020In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration.CVE-2020-15102 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
- Product
- dashproducts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admiCVE-2020-4074 · Websites & servers · PrestaShop · reported by GitHubHigh 8.9
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS.CVE-2020-15083 · Websites & servers · PrestaShop · reported by GitHubMedium 4.7
In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables.CVE-2020-15082 · Websites & servers · PrestaShop · reported by GitHubHigh 7.1
In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory.CVE-2020-15081 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible.CVE-2020-15080 · Websites & servers · PrestaShop · reported by GitHubMedium 5.3
In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The problem is fixed in version 1.7.6.6 A possible workaround is to make sure `composer.json` and `docker-compose.yml` are not accessible on your server.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions.CVE-2020-15079 · Websites & servers · PrestaShop · reported by GitHubMedium 6.4
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The problem is fixed in version 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item.CVE-2020-11074 · Websites & servers · PrestaShop · reported by GitHubMedium 5.4
In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item. The problem is fixed in 1.7.6.6.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentialCVE-2020-2210 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Product
- Jenkins Stash Branch Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jun 17, 2020An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms.CVE-2020-13637 · Other software · Heinekingmedia · reported by MITREHigh 7.5
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context.
- Product
- Stashcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvanlaak.dejvanlaak.de
May 18, 2020An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms.CVE-2020-13129 · Other software · Heinekingmedia · reported by MITREHigh 7.2
An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with client_key and device_id data in the query string, which allows attackers to obtain sensitive information by reading web-server logs.
- Product
- Stashcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvanlaak.dejvanlaak.de
Apr 27, 2020The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can beCVE-2020-12120 · Websites & servers · Prestashop · reported by MITREHigh 7.5
The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner password that can be used to modify orders via SOAP. Attackers can also retrieve information about orders or buyers.
- Product
- Correos Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comia-informatica.com
Apr 20, 2020In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices.CVE-2020-5293 · Websites & servers · PrestaShop · reported by GitHubMedium 6.5
In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page.CVE-2020-5288 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search.CVE-2020-5287 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file.CVE-2020-5286 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter.CVE-2020-5285 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers.CVE-2020-5279 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5CVE-2020-5278 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5CVE-2020-5276 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters.CVE-2020-5272 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with `alias` and `search` parameters. The problem is patched in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixCVE-2020-5271 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is a reflected XSS with `date_from` and `date_to` parameters in the dashboard page This problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter.CVE-2020-5270 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is an open redirection when using back parameter. The impacts can be many, and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminFeatures page by using the `id_feature` parameter.CVE-2020-5269 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminFeatures page by using the `id_feature` parameter. The problem is fixed in 1.7.6.5
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page.CVE-2020-5265 · Websites & servers · PrestaShop · reported by GitHubMedium 4.4
In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page. The problem is patched in 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page.CVE-2020-5264 · Websites & servers · PrestaShop · reported by GitHubMedium 4.4
In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2020PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0CVE-2020-5294 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0
- Product
- ps_socialfollow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2020In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs.CVE-2020-5273 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0
- Product
- ps_linklist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2020In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field.CVE-2020-5266 · Websites & servers · PrestaShop · reported by GitHubMedium 4.4
In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0
- Product
- ps_linklist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2020PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter.CVE-2020-5277 · Websites & servers · PrestaShop · reported by GitHubMedium 4.1
PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0
- Product
- ps_facetedsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2020Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resultingCVE-2020-2143 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Product
- Jenkins Logstash Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 5, 2020In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's addrCVE-2020-5250 · Websites & servers · PrestaShop · reported by GitHubHigh 7.6
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2020PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload moduleCVE-2013-6295 · Websites & servers · Prestashop · reported by MITRECritical 9.8
PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddavidsopaslabs.blogspot.comdavidsopaslabs.blogspot.com
Feb 13, 2020PrestaShop before 1.4.11 allows logout CSRF.CVE-2013-4792 · Websites & servers · Prestashop · reported by MITREMedium 5.5
PrestaShop before 1.4.11 allows logout CSRF.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddavidsopaslabs.blogspot.comdavidsopaslabs.blogspot.com
Feb 13, 2020PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.CVE-2013-4791 · Websites & servers · Prestashop · reported by MITREMedium 5.4
PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddavidsopaslabs.blogspot.comdavidsopaslabs.blogspot.com
Feb 11, 2020Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[CVE-2012-2517 · Websites & servers · Prestashop · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhtbridge.comprestashop.com
Jan 23, 2020PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.CVE-2013-6358 · Websites & servers · Prestashop · reported by MITREHigh 8.8
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Jan 8, 2020In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link.CVE-2020-6632 · Websites & servers · Prestashop · reported by MITREMedium 6.1
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2019reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to executeCVE-2019-19595 · Other software · Adobe · reported by MITRECritical 9.8
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
- Product
- Stock API Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordia-informatica.comia-informatica.com
Dec 5, 2019reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary CVE-2019-19594 · Other software · Adobe · reported by MITRECritical 9.8
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
- Product
- Stock API Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordia-informatica.comia-informatica.com
Oct 30, 2019Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin.CVE-2019-7620 · Other software · Elastic · reported by security@elastic.coHigh 7.5
Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding.
- Product
- Logstash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Aug 26, 2019The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.CVE-2019-15565 · Other software · Webimpacto · reported by MITRECritical 9.8
The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
- Product
- Icommktconnector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2019In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability duCVE-2019-13461 · Websites & servers · Prestashop · reported by MITREHigh 7.5
In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.prestashop2.comblog.hacktivesecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.