Prestashop: >> Prestashop >> 1.7.3.1 Security Vulnerabilities
In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable value sent to the web application during checkout. An attacker could leak personal customer information. This is PrestaShop bug #14444.
CVSS Score
7.5
EPSS Score
0.004
Published
2019-07-09
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files.
CVSS Score
7.5
EPSS Score
0.004
Published
2018-11-09
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
CVSS Score
7.5
EPSS Score
0.167
Published
2018-11-09
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.
CVSS Score
9.8
EPSS Score
0.559
Published
2018-11-09
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.
CVSS Score
9.1
EPSS Score
0.2
Published
2018-07-09
Page 5