CVE-2019-8151

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-side request forgery due to unsafe handling of a carrier...

CVE-2019-8150

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout...

CVE-2019-8150

CVE-2019-8150 is a remote code execution vulnerability in Magento. It affects Magento 2.2.x before 2.2.10 and Magento 2.3.x before 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout, resulting in RCE with H...

CVE-2019-8149

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication...

CVE-2019-8149

CVE-2019-8149 affects Magento: insecure authentication and session management in Magento 2.2 < 2.2.10 and Magento 2.3

CVE-2019-8148

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder...

CVE-2019-8148

CVE-2019-8148 affects Magento 2.3 up to versions prior to 2.3.3 or 2.3.2-p1. The vulnerability is a stored cross-site scripting (XSS) flaw where an authenticated admin user can inject arbitrary JavaScript code when creating a content page via the page builder. This could result in script executio...

CVE-2019-8147

The CVE-2019-8147 entry describes a stored XSS vulnerability in Magento 2.x (before 2.2.10 and before 2.3.3 or 2.3.2-p1). An authenticated user can inject arbitrary JavaScript via a customer attribute label, enabling script execution in affected users’ browsers. Connected sources corroborate this...

CVE-2019-8147

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via customer attribute label...

CVE-2019-8146

CVE-2019-8146 is a stored cross-site scripting (XSS) flaw in Magento: affected are Magento 2.2 versions before 2.2.10 and Magento 2.3 versions before 2.3.3 or 2.3.2-p1. The vulnerability allows an authenticated user to inject arbitrary JavaScript when adding a new customer attribute for stores. T...

CVE-2019-8146

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores...

CVE-2019-8144

Magento 2.3 (before 2.3.3 or 2.3.2-p1) is affected by a remote code execution vulnerability via PageBuilder template methods. An unauthenticated attacker can supply a payload to achieve RCE. Mitigation is to apply the Magento security patch 2.3.3 (and 2.2.10) as cited in security advisories; no e...

CVE-2019-8144

A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods...

CVE-2019-8143

CVE-2019-8143 affects Magento: Magento 2.2 versions before 2.2.10 and Magento 2.3 versions before 2.3.3 or 2.3.2-p1 are vulnerable. An authenticated user with access to email templates can issue malicious SQL queries to access sensitive data. Remediation: upgrade to Magento 2.2.10 or 2.3.3 (or ne...

CVE-2019-8143

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database...

CVE-2019-8142

CVE-2019-8142 is a stored XSS vulnerability affecting Magento 2.2 (before 2.2.10) and Magento 2.3 (before 2.3.3 or 2.3.2-p1). An authenticated user can inject arbitrary JavaScript via the order title when configuring sales payment methods. The issue is triggered in the merchant-facing configurati...

CVE-2019-8142

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via title of an order when configuring sales payment methods for a store...

CVE-2019-8141

CVE-2019-8141 affects Magento open-source platforms Magento 2.1 (before 2.1.19), Magento 2.2 (before 2.2.10), and Magento 2.3 (before 2.3.3). The issue is a remote code execution via a Phar deserialization vulnerability in the system-level import functionality, exploitable by an authenticated use...

CVE-2019-8141

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges system level import can execute arbitrary code through a Phar deserialization vulnerability in the import...

CVE-2019-8140

CVE-2019-8140 affects Magento 2.x: versions prior to 2.2.10 (and 2.3 prior to 2.3.3 or 2.3.2-p1) are vulnerable. An authenticated admin can exploit the Media File Storage Synchronization to convert uploaded JPEGs into PHP files, enabling unrestricted file upload. Root cause: improper handling in ...