Enabled an attacker to execute JavaScript in the context of a customer session. If a customer clicks a malicious link, the attacker can steal cookies and hijack the session, which can expose personal information and compromise checkout. Part of patch SUPEE-5994 Weiterlesen: [APPSEC-907] Cross site scripting using Authorize.Net direct post module
Intelligence View
⚡ tsecurity.de Intelligence
[APPSEC-907] Cross site scripting using Authorize.Net direct post module
Enabled an attacker to execute JavaScript in the context of a customer session. If a customer clicks a malicious link, the attacker can steal cookies and…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
12 Quellen
CVE-2026-85835 | Microsoft Windows up to Server 2025 Servicing Stack out-of-bounds (EUVD-2026-99544)
11 weitere Quellen
VVulDB Updatesvor 56 Min.CVE-2026-85834 | Microsoft Windows up to Server 2025 TCP IP heap-based overflow (EUVD-2026-99543) VVulDB Updatesvor 56 Min.CVE-2026-85833 | Microsoft Windows up to Server 2025 Modern Device Management use after free (EUVD-2026-99542) VVulDB Updatesvor 56 Min.CVE-2026-85832 | Microsoft Windows up to Server 2025 Background Intelligent Transfer Service buffer overflow (EUVD-2026-99541) VVulDB Updatesvor 56 Min.CVE-2026-85831 | Microsoft Windows up to Server 2025 Windows Biometric Service buffer overflow (EUVD-2026-99540) VVulDB Updatesvor 56 Min.CVE-2026-85830 | Microsoft Windows up to Server 2025 Installer out-of-bounds (EUVD-2026-99539) VVulDB Updatesvor 1 Std.CVE-2026-85843 | Microsoft Windows up to Server 2025 Background Intelligent Transfer Service uninitialized resource (EUVD-2026-99549)
+5
12 Quellen
[APPSEC-1019] Autoloaded File Inclusion in Magento SOAP API
11 weitere Quellen
VVulnerability definition fe…vor 8 Jahren[APPSEC-1020] SSRF Vulnerability in WSDL file VVulnerability definition fe…vor 8 Jahren[APPSEC-1247] Magento 2 - Block cache exploit VVulnerability definition fe…vor 8 Jahren[APPSEC-1422] Magento 2 - Customer account takeover VVulnerability definition fe…vor 8 Jahren[APPSEC-1338] Magento 2 - Full Page Cache poisoning VVulnerability definition fe…vor 8 Jahren[APPSEC-1433] Magento 2 - Unauthorized removal of customer address VVulnerability definition fe…vor 8 Jahren[APPSEC-1303] Magento 2 - Weak encryption keys when generated from Manage Encryption Keys page
+5
12 Quellen
[6363] Added int for invoice id in order to prevent SQL injection in OrderInvoice class
11 weitere Quellen
VVulnerability definition fe…vor 8 Jahren[6366] Added intval in order to prevent SQL injection to $id_shop_list in ObjectModel VVulnerability definition fe…vor 7 JahrenAdded several escapes for the social and sitemap management pages to prevent XSS VVulnerability definition fe…vor 7 JahrenAdded several escapes to the bulk editor to prevent XSS VVulnerability definition fe…vor 7 JahrenAdded escapes to knowledge graph to prevent XSS VVulnerability definition fe…vor 7 JahrenAdded escape to the label value of toggle switch to prevent XSS VVulnerability definition fe…vor 7 JahrenAdded serveral strip all tags in the admin trackin plugin, frontend class and breadcrumbs class to prevent XSS
+5
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4277592/sichere-programmierung/appsec-907-cross-site-scripting-using-authorizenet-direct-post-module/