Security News > 2020 > January > Magento patches critical code execution vulnerabilities, upgrade ASAP!
Adobe-owned Magento has plugged multiple critical vulnerabilities in its eponymous content management system, the most severe of which could be exploited by attackers to achieve arbitrary code execution.
According to the newest Magento-themed security bulletin, three of the six fixed flaws are critical and three are important.
In the "Important" category are two stored cross-site scripting flaws and a path traversal vulnerability, all of which could lead to sensitive information disclosure.
Magento is one of the most popular open-source e-commerce platforms out there, but web stores running it have unfortunately become a prime - though not exclusive - target for card-skimming cybercriminals.
Vulnerabilities in the Magento core are just one vector through which attackers can gain access to online shops to insert card-skimming code into them.
News URL
http://feedproxy.google.com/~r/HelpNetSecurity/~3/EBvq8zYCh2Y/
Related news
- Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications (source)
- Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited (source)
- HPE Issues Critical Security Patches for Aruba Access Point Vulnerabilities (source)
- OvrC Platform Vulnerabilities Expose IoT Devices to Remote Attacks and Code Execution (source)
- Patch Tuesday: Four Critical Vulnerabilities Paved Over (source)
- Critical vulnerabilities persist in high-risk sectors (source)