CVE-2019-8228

in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template...

CVE-2019-8229

CVE-2019-8229 affects Magento: prior to 1.9.4.3 and prior to 1.14.4.3, an authenticated admin who can edit product attributes can execute arbitrary code via crafted layout updates. Impact per sources includes high/critical in CVSS metrics. Remediation is available: apply the Magento patch SUPEE-1...

CVE-2019-8229

In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates...

CVE-2019-8230

Magento Open Source/Commerce prior to 1.9.4.3 / 1.14.4.3 is affected. An authenticated administrator who can edit configuration settings can execute arbitrary code via a crafted request to the support/output path. Root cause appears related to improper handling of the support/output path (path tr...

CVE-2019-8230

In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path...

CVE-2019-8231

CVE-2019-8231 affects Magento up to 1.9.4.3 and Magento prior to 1.14.4.3. An authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification, enabling remote code execution. The issue is caused by improper handling of att...

CVE-2019-8231

In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification...

CVE-2019-8232

In Magento, versions affected include 1.x up to 1.9.4.3, 1.14.4.3, 2.2 up to 2.2.10, and 2.3 up to 2.3.3 or 2.3.2-p1. The issue is a race condition that, when an authenticated admin uses the import feature, enables arbitrary code execution by modifying the webserver configuration file. This is th...

CVE-2019-8232

In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file...

CVE-2019-8233

In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...

CVE-2019-8233

CVE-2019-8233 affects Magento 2.2.x prior to 2.2.10 and Magento 2.3.x prior to 2.3.3 (or 2.3.2-p1). The root cause is a sanitization engine that ignores HTML comments, allowing an unauthenticated user to inject arbitrary JavaScript code. Practical impact is JavaScript injection in affected Magent...

CVE-2019-8155

Magento Open Source <1.9.4.3 and Commerce

CVE-2019-8155

Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions...

CVE-2019-8154

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update...

CVE-2019-8154

CVE-2019-8154 describes a remote code execution in Magento 2.x prior to certain patched versions. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion by submitting a crafted XML file that specifies product design update. Affected versions include Magent...

CVE-2019-8153

The CVE-2019-8153 entry describes a mitigation bypass that allows bypassing Magento’s escapeURL() and executing a malicious XSS payload. Affected are Magento 2.2 versions before 2.2.10 and Magento 2.3 versions before 2.3.3 or 2.3.2-p1. Impact is client-facing XSS due to bypassed URL escaping; CVS...

CVE-2019-8153

A mitigation bypass to prevent cross-site scripting XSS exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the escapeURL function and execute a malicious XSS payload...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

Magento 1: stored XSS via wysiwyg blockDirective() in admin cache affects 1.x before 1.9.4.3 and 1.14.4.3; Magento 2: affected if below 2.2.10 (2.2) or below 2.3.3 (2.3) or 2.3.2-p1. Authenticated user with wysiwyg editor access can inject JavaScript into the admin dashboard cache. Mitigation/pat...

CVE-2019-8151

CVE-2019-8151 affects Magento: versions 2.2 before 2.2.10 and 2.3 before 2.3.3, or 2.3.2-p1, are vulnerable. It requires an authenticated admin to manipulate shipping settings and can lead to remote code execution via server-side request forgery caused by unsafe handling of a carrier gateway. The...