Vulnerabilities > Magento > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-09-26 CVE-2015-8707 Information Exposure vulnerability in Magento
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
network
low complexity
magento CWE-200
5.0
2017-09-20 CVE-2014-9758 Cross-site Scripting vulnerability in Magento 1.9.0.1
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
network
magento CWE-79
4.3
2017-03-01 CVE-2016-6485 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Magento Magento2
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
network
low complexity
magento CWE-327
5.0
2016-04-15 CVE-2016-2212 Information Exposure vulnerability in Magento
The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status.
network
low complexity
magento CWE-200
5.0
2015-04-29 CVE-2015-3458 Permissions, Privileges, and Access Controls vulnerability in Magento 1.14.1.0/1.9.1.0
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function.
network
low complexity
magento CWE-264
6.5
2015-04-29 CVE-2015-3457 Improper Authentication vulnerability in Magento 1.14.1.0/1.9.1.0
Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.
network
low complexity
magento CWE-287
5.0
2015-04-29 CVE-2015-1399 Code Injection vulnerability in Magento 1.14.1.0/1.9.1.0
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.
network
low complexity
magento CWE-94
6.5
2015-04-29 CVE-2015-1398 Path Traversal vulnerability in Magento 1.14.1.0/1.9.1.0
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) ..
network
low complexity
magento CWE-22
6.5
2015-04-29 CVE-2015-1397 SQL Injection vulnerability in Magento 1.14.1.0/1.9.1.0
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
network
low complexity
magento CWE-89
6.5