The REST and SOAP service input processor converted attacker-supplied request data into constructor arguments without restricting the target type, so a crafted API request could have arbitrary classes instantiated from untrusted input. This is the SessionReaper issue and can lead to session takeover and remote code execution without... Weiterlesen: Improper Input Validation in Magento Web API Service Input Processor
Intelligence View
⚡ tsecurity.de Intelligence
Improper Input Validation in Magento Web API Service Input Processor
The REST and SOAP service input processor converted attacker-supplied request data into constructor arguments without restricting the target type, so a crafted…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
10 Quellen
CVE-2022-47653 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c eac3_update_channels buffer overflow (Issue 2349 / EUVD-2022-50412)
9 weitere Quellen
VVulDB Updatesvor 3 Std.CVE-2022-47654 | GPAC 2.1-DEV-rev593-g007bf61a0 MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2350 / EUVD-2022-50413) VVulDB Updatesvor 3 Std.CVE-2022-47656 | GPAC 2.1-DEV-rev617-g85ce76efd MP4box media_tools/av_parsers.c gf_hevc_read_sps_bs_internal buffer overflow (Issue 2353 / EUVD-2022-50415) VVulDB Updatesvor 3 Std.CVE-2022-47659 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4box gf_bs_read_data buffer overflow (Issue 2354 / EUVD-2022-50418) VVulDB Updatesvor 3 Std.CVE-2022-47658 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c gf_hevc_read_vps_bs_internal buffer overflow (Issue 2356 / EUVD-2022-50417) VVulDB Updatesvor 3 Std.CVE-2022-47657 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box media_tools/av_parsers.c hevc_parse_vps_extension buffer overflow (Issue 2355 / EUVD-2022-50416) VVulDB Updatesvor 3 Std.CVE-2022-47660 | GPAC 2.1-DEV-rev644-g5c4df2a67 MP4Box isomedia/isom_write.c integer overflow (Issue 2357 / EUVD-2022-50419)
+3
8 Quellen
CVE-2025-68729 | Linux Kernel up to 6.17.12/6.18.1 wifi ath12k_hal_desc_reo_parse_err buffer overflow (Nessus ID 279834 / WID-SEC-2025-2920)
7 weitere Quellen
VVulDB Updatesvor 2 Std.CVE-2025-68374 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 md_wakeup_thread use after free (Nessus ID 279706 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68359 | Linux Kernel up to 6.17.12/6.18.1 btrfs kfree double free (Nessus ID 279727 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68360 | Linux Kernel up to 6.17.12/6.18.1 wed_hif2 state issue (Nessus ID 279699 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68368 | Linux Kernel up to 6.18.1 md_run null pointer dereference (Nessus ID 279769 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68356 | Linux Kernel up to 6.12.62/6.17.12/6.18.1 new_inode allocation of resources (Nessus ID 279734 / WID-SEC-2025-2920) VVulDB Updatesvor 2 Std.CVE-2025-68353 | Linux Kernel up to 6.18.1 net vxlan_xmit_one null pointer dereference (Nessus ID 279713 / WID-SEC-2025-2920)
+1
7 Quellen
CVE-2025-58611 | Tickera Plugin up to 3.5.5.6 on WordPress cross-site request forgery
6 weitere Quellen
VVulDB Updatesvor 3 Std.CVE-2025-9823 | Mautic up to 4.4.16/5.2.7/6.0.4 ajax?action=lead:addLeadTags cross site scripting VVulDB Updatesvor 3 Std.CVE-2025-58605 | WP Delicious Plugin up to 1.8.7 on WordPress cross site scripting VVulDB Updatesvor 3 Std.CVE-2025-58603 | Surfer Plugin up to 1.6.4.574 on WordPress authorization VVulDB Updatesvor 3 Std.CVE-2025-58593 | Themeisle Orbit Fox Plugin up to 3.0.0 on WordPress cross site scripting VVulDB Updatesvor 3 Std.CVE-2025-58351 | Outline up to 0.83.x cross site scripting (GHSA-gcj7-c9jv-fhgf) VVulDB Updatesvor 4 Std.CVE-2026-115796 | Tenda F6 12.02.01.73 Web Management Interface cross-site request forgery
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4291557/sicherheitsluecken-cve/improper-input-validation-in-magento-web-api-service-input-processor/