openmage/magento-lts vulnerabilities (Packagist)
26 vulnerabilities.
openmage/magento-ltsPackagistMagento LTS: Reflected XSS - Import -> Data Flow (profiles)5.3 Mediumopenmage/magento-ltsPackagistMagento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts6.1 Mediumopenmage/magento-ltsPackagistMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs9.3 Criticalopenmage/magento-ltsPackagistOpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution8.7 Highopenmage/magento-ltsPackagistOpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant5.3 Mediumopenmage/magento-ltsPackagistOpenMage LTS has Path Traversal Filter Bypass in Dataflow Module4.9 Mediumopenmage/magento-ltsPackagistOpenMage LTS's Phar Deserialization leads to Remote Code Execution8.1 Highopenmage/magento-ltsPackagistMagento's X-Original-Url header can expose admin url5.3 Mediumopenmage/magento-ltsPackagistOpenMage is vulnerable to XSS in Admin Notifications4.6 Mediumopenmage/magento-ltsPackagistMagento vulnerable to stored XSS in theme config fields2.9 Lowopenmage/magento-ltsPackagistMagento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs4.1 Mediumopenmage/magento-ltsPackagistMagento LTS vulnerable to stored XSS in admin file form5.4 Mediumopenmage/magento-ltsPackagistMagento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor7.5 Highopenmage/magento-ltsPackagistMagento LTS's guest order "protect code" can be brute-forced too easily7.5 Highopenmage/magento-ltsPackagistOpenMage LTS DataFlow upload remote code execution vulnerability7.2 Highopenmage/magento-ltsPackagistOpenMage LTS authenticated remote code execution through layout update8.8 Highopenmage/magento-ltsPackagistOpenMage LTS has DoS vulnerability in MaliciousCode filter4.9 Mediumopenmage/magento-ltsPackagistOpenMage LTS arbitrary file deletion in customer media allows for remote code execution7.2 Highopenmage/magento-ltsPackagistOpenMage LTS arbitrary command execution in custom layout update through blocks7.2 Highopenmage/magento-ltsPackagistMagneto-lts vulnerable to Cross-Site Request Forgery4.2 Mediumopenmage/magento-ltsPackagistData Flow Sanitation Issue Fix7.2 Highopenmage/magento-ltsPackagistLayout XML Arbitrary Code Fix7.2 Highopenmage/magento-ltsPackagistBackport for CVE-2021-21024 Blind SQLi from Magento 29.1 Criticalopenmage/magento-ltsPackagistFixes a bug in Zend Framework's Stream HTTP Wrapper9.8 Criticalopenmage/magento-ltsPackagistRCE in Magento8.0 Highopenmage/magento-ltsPackagistObservable Timing Discrepancy in OpenMage LTS8.0 High