Search for packages
| purl | pkg:composer/shopware/shopware@5.2.23 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-14v3-bjew-3qby
Aliases: CVE-2017-18357 GHSA-6m27-7cqj-2mxw |
Externally Controlled Reference to a Resource in Another Sphere Shopware has a PHP Object Instantiation issue via the `sort` parameter to the `loadPreviewAction()` method of the `Shopware_Controllers_Backend_ProductStream` controller, with resultant XXE via instantiation of a `SimpleXMLElement` object. |
Affected by 10 other vulnerabilities. |
|
VCID-4han-wpdy-nfew
Aliases: CVE-2020-13970 GHSA-5vmg-x99g-396q |
Shopware is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server. |
Affected by 0 other vulnerabilities. |
|
VCID-51d6-x2aj-xfb9
Aliases: GHSA-28fw-88hq-6jmm GMS-2020-599 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in shopware/shopware. |
Affected by 0 other vulnerabilities. |
|
VCID-6zw9-8ykf-mqb6
Aliases: GMS-2018-77 |
Cross-site Scripting Non-Persistent XSS in shopware. |
Affected by 12 other vulnerabilities. |
|
VCID-7vfc-esw6-abht
Aliases: GHSA-hrfh-fp4x-crrq GMS-2020-601 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in shopware/shopware. |
Affected by 0 other vulnerabilities. |
|
VCID-97e5-qak3-e3fa
Aliases: SW-20878 |
Non-Persistent XSS Shopware is affected by two non-persistent Cross-site Scripting (XSS) vulnerabilities in the frontend. |
Affected by 9 other vulnerabilities. |
|
VCID-carh-gr9g-vqfs
Aliases: CVE-2020-13997 GHSA-r4ph-mx67-x58p |
Information Exposure Through an Error Message In Shopware, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. |
Affected by 0 other vulnerabilities. |
|
VCID-h6qp-71jr-3fef
Aliases: CVE-2019-12799 GHSA-rf8f-hqjv-986p |
Deserialization of Untrusted Data In `createInstanceFromNamedArguments` in Shopware, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. |
Affected by 6 other vulnerabilities. |
|
VCID-hymt-whub-abag
Aliases: CVE-2020-13971 GHSA-fxf3-wx3c-76pf |
Cross-site Scripting In Shopware, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication. |
Affected by 0 other vulnerabilities. |
|
VCID-k6uh-wqnr-wfas
Aliases: GHSA-6gv9-7q4g-pmvm GMS-2020-600 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in shopware/shopware. |
Affected by 0 other vulnerabilities. |
|
VCID-kn8n-n4z7-v3f2
Aliases: CVE-2017-15374 GHSA-mvrx-cmqw-2jgj |
Cross-site Scripting Shopware is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. |
Affected by 10 other vulnerabilities. |
|
VCID-nvv7-js5y-gfbk
Aliases: GMS-2017-135 |
Remote Code Execution Vulnerability Under certain circumstances, it’s possible to execute an authorized foreign code in Shopware. |
Affected by 13 other vulnerabilities. |
|
VCID-rqsr-zpk3-kuhm
Aliases: CVE-2018-20713 GHSA-42gv-77f4-r3j9 |
Shopware allows SQL Injection by remote authenticated users. |
Affected by 8 other vulnerabilities. |
|
VCID-t7re-q293-zfe7
Aliases: GMS-2017-343 |
Code Injection Remote Code Execution Vulnerability in shopware. |
Affected by 13 other vulnerabilities. |
|
VCID-xbs4-xa24-5ycg
Aliases: CVE-2019-12935 GHSA-8qxh-hcr9-2379 |
Cross-site Scripting Shopware has XSS via the Query String to the `backend/Login` or `backend/Login/load/` URI. |
Affected by 7 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||