[APPSEC-1012] Cross-site scripting in orders RSS

The vulnerability allowed an attacker to include an unescaped customer name in the New Orders RSS feed. By manipulating the customer name, an attacker could inject incorrect or malicious data into the feed, and expose the store to risk. Patch is part of SUPEE-6285 This vulnerability affects the following application versions: Magento 1.4.0.0... Weiterlesen: [APPSEC-1012] Cross-site scripting in orders RSS