Security News > 2020 > January > Magento patches critical code execution vulnerabilities, upgrade ASAP!
Adobe-owned Magento has plugged multiple critical vulnerabilities in its eponymous content management system, the most severe of which could be exploited by attackers to achieve arbitrary code execution.
According to the newest Magento-themed security bulletin, three of the six fixed flaws are critical and three are important.
In the "Important" category are two stored cross-site scripting flaws and a path traversal vulnerability, all of which could lead to sensitive information disclosure.
Magento is one of the most popular open-source e-commerce platforms out there, but web stores running it have unfortunately become a prime - though not exclusive - target for card-skimming cybercriminals.
Vulnerabilities in the Magento core are just one vector through which attackers can gain access to online shops to insert card-skimming code into them.
News URL
http://feedproxy.google.com/~r/HelpNetSecurity/~3/EBvq8zYCh2Y/
Related news
- Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper-V Flaws (source)
- PoC for critical Arcserve UDP vulnerabilities published (CVE-2024-0799, CVE-2024-0800) (source)
- Patch up – 4 critical bugs in ArubaOS lead to remote code execution (source)
- Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks (source)
- Critical Tinyproxy Flaw Opens Over 50,000 Hosts to Remote Code Execution (source)