Magento Remote Code Execution Vulnerability (CNVD-2019-40733)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A remote code execution vulnerability exists in Magento. An attacker can exploit this vulnerability to execute arbitrary code...

Magento cross-site scripting vulnerability (CNVD-2019-40747)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . Magento has a cross-site scripting vulnerability. Attackers can use this vulnerability to execute client-side co...

Magento Input Validation Error Vulnerability (CNVD-2019-40758)

Magento is an open source PHP e-commerce system from the U.S. company Magento. An input validation error vulnerability exists in Magento. An attacker can exploit this vulnerability to insert a malicious payload into the page layout to achieve remote code execution...

Magento SQL Injection Vulnerability (CNVD-2019-40753)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. Magento has a SQL injection vulnerability. An attacker can exploit this vulnerability to execute illegal SQL comman...

Magento Authorization Issues Vulnerability (CNVD-2019-40734)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . Magento has an authorization problem vulnerability. An unauthenticated attacker can exploit this vulnerability t...

Magento Remote Code Execution Vulnerability (CNVD-2019-40759)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A remote code execution vulnerability exists in Magento. An attacker can exploit this vulnerability to insert a malicious payload to achieve remote code execution...

Magento Remote Code Execution Vulnerability (CNVD-2019-40728)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A remote code execution vulnerability exists in Magento. An attacker can exploit this vulnerability to execute co...

Magento cross-site scripting vulnerability (CNVD-2019-40736)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A cross-site scripting vulnerability exists in Magento. An attacker can exploit this vulnerability to inject malicious JavaScript into the management console cache...

Magento cross-site scripting vulnerability (CNVD-2019-40745)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento has a cross-site scripting vulnerability. Attackers can use this vulnerability to execute client-side cod...

Magento cross-site scripting vulnerability (CNVD-2019-40746)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento has a cross-site scripting vulnerability. Attackers can use this vulnerability to execute client-side cod...

Magento cross-site scripting vulnerability (CNVD-2019-40744)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento has a cross-site scripting vulnerability. Attackers can use this vulnerability to execute client-side cod...

Magento Remote Code Execution Vulnerability (CNVD-2019-40756)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A remote code execution vulnerability exists in Magento. An attacker can exploit this vulnerability to execute code...

Magento Remote Code Execution Vulnerability (CNVD-2019-40757)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A remote code execution vulnerability exists in Magento. An attacker can exploit this vulnerability to trigger a PHP file inclusion to achieve remote code execution...

Magento Remote Code Execution Vulnerability (CNVD-2019-40731)

Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento has a remote code-in-play vulnerability. An attacker can exploit the vulnerability by arbitrary file deletion and OS command injection to execute arbitrary code...

Magento 2.3.x < 2.3.3 or 2.3.2-p1 Multiple Vulnerabilities (Oct 2019)

Magento is prone to multiple vulnerabilities, including remote code execution RCE, and cross-site scripting XSS. See the referenced advisories for further details on each specific vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced...

Magento Server-Side Request Forgery Vulnerability

Magento is an open source PHP e-commerce system from the U.S. company Magento. Magento has a server-side request forgery vulnerability. An attacker can exploit this vulnerability to manipulate the connector api endpoints to achieve remote code execution...

Magento 2.2.x < 2.2.10, 2.3.x < 2.3.3 or 2.3.2-p1 Multiple Vulnerabilities (Oct 2019)

Magento is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:magentocommerce:magento"; if...

CVE-2019-8158

An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data...

CVE-2019-8156

A server-side request forgery SSRF vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution...

CVE-2019-8157

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization...