Virtuemart plugin magiczoomplus v4.9.4 and previous, Sensitive information disclosure, Insecure folder permissions, Remote call information disclosure.
Resolution: Update to 4.9.6
Update notice: https://www.magictoolbox.com/jv-release-update/
Note that the VEL do not agree with the developer's description of these as "low level security issues"