Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated: PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication MAG-23: M1 Credit Card Storage Capability PRODSECBUG-2149: Authenticated RCE using customer import PRODSECBUG-2159: API Based RCE Vulnerability PRODSECBUG-2156: RCE Via Unauthorized Upload PRODSECBUG-2155: Authenticated RCE using dataflow PRODSECBUG-2053: Prevents XSS in Newsletter Template PRODSECBUG-2142: XSS in CMS Preview PRODSECBUG-1860: Admin Account XSS Attack Cessation via Filename PRODSECBUG-2119: EE Patch to include names in templates PRODSECBUG-2129: XSS in Google Analytics Vulnerability PRODSECBUG-2019: Merchant Wishlist Security Strengthening PRODSECBUG-2104: Send to a Friend Vulnerability PRODSECBUG-2125: CSRF on deletion of Blocks Vulnerability PRODSECBUG-2088: CSRF Vulnerability related to Customer Group Deletion PRODSECBUG-2140: CSRF on deletion of Site Map PRODSECBUG-2108: Outdated jQuery causing PCI scanning failures MAG-12, MAG-2: Encryption Keys Stored in Plain Text PRODSECBUG-2141: Unauthorized Admin Panel Bypass Patching and Upgrading: Patches and upgrades are available for the following Magento versions: Magento Commerce 1.9.0.0-1.14.4.0: Apply SUPEE-10975 or upgrade to…Read More