Security News > 2020 > January > Magento patches critical code execution vulnerabilities, upgrade ASAP!
Adobe-owned Magento has plugged multiple critical vulnerabilities in its eponymous content management system, the most severe of which could be exploited by attackers to achieve arbitrary code execution.
According to the newest Magento-themed security bulletin, three of the six fixed flaws are critical and three are important.
In the "Important" category are two stored cross-site scripting flaws and a path traversal vulnerability, all of which could lead to sensitive information disclosure.
Magento is one of the most popular open-source e-commerce platforms out there, but web stores running it have unfortunately become a prime - though not exclusive - target for card-skimming cybercriminals.
Vulnerabilities in the Magento core are just one vector through which attackers can gain access to online shops to insert card-skimming code into them.
News URL
http://feedproxy.google.com/~r/HelpNetSecurity/~3/EBvq8zYCh2Y/
Related news
- Elastic Releases Urgent Fix for Critical Kibana Vulnerability Enabling Remote Code Execution (source)
- GitLab patches critical authentication bypass vulnerabilities (source)
- Ongoing Cyber Attacks Exploit Critical Vulnerabilities in Cisco Smart Licensing Utility (source)
- OpenAI now pays researchers $100,000 for critical vulnerabilities (source)
- Still Using an Older Version of iOS or iPadOS? Update Now to Patch These Critical Security Vulnerabilities (source)
- Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw (source)
- Adobe Patches 11 Critical ColdFusion Flaws Amid 30 Total Vulnerabilities Discovered (source)
- Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution (source)
- Most critical vulnerabilities aren’t worth your attention (source)