Contents
Which is the latest version of Magento supee?
Patches and upgrades are available for the following Magento versions: Enterprise Edition 1.9.0.0-1.14.3.2: SUPEE-9767 or upgrade to Enterprise Edition 1.14.3.3 Community Edition 1.5.0.1-1.9.3.2: SUPEE-9767 or upgrade to Community Edition 1.9.3.3 To download a patch or release, choose from the following options:
How to enable and disable symlinks in Magento?
Before applying the patch or upgrading to the latest release, make sure to disable Symlinks setting in System > Configuration > Advanced > Developer > Enable Symlinks. The setting, if enabled, will override configuration file setting and changing it will require direct database modification.
What’s the latest version of supee Enterprise Edition?
SUPEE-9767, Enterprise Edition 1.14.3.3 and Community Edition 1.9.3.3 address several security issues. Before applying the patch or upgrading to the latest release, make sure to disable Symlinks setting in System > Configuration > Advanced > Developer > Enable Symlinks.
Is there a SQL injection vulnerability in Magento?
Magento CE prior to 1.9.3.3, and Magento EE prior to 1.14.3.3, Magento 2.0 prior to 2.0.14, Magento 2.1 prior to 2.1.7 The Visual Merchandiser contains an SQL injection vulnerability that can potentially allow a user with Admin privileges to directly edit the database.
Is there a security patch for Magento 1.9.3.4?
Magento has released SUPEE-9767 V2 and CE 1.9.3.4 to address many of the issues from the initial patch. If you applied V1, you should revert and then apply V2. If you haven’t patched yet, just apply V2, and most of the issues brought up here will not be relevant.
Why is my Magento account not registering as a guest?
Magento received reports that customer registration after checkout might fail if option to ‘Enable Form Key Validation On Checkout’ is enabled. This results in customers not being registered, but checking out as guests. Magento is working on updated version of the patch.
Is it possible to insert malicious JavaScript in Magento?
It is possible to use the Magento Enterprise Edition invitations feature to insert malicious JavaScript that might be executed in the admin context. With access to any CMS functionality, an attacker with administrator permissions can use blocks to exfiltrate information stored in cache.