Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address...

Remote code execution

A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload...

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview...

Authentication flaw

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a guest session id value following a successful login to gain access to customer account index page...

Remote code execution

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin functionality related to email templates to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code...

CVE-2019-8133

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can bypass configuration that restricts directory access. The bypass allows overwrite of a subset of configuration files which can lead to...

CVE-2019-8133

CVE-2019-8133 affects Magento: Magento 2.2.x before 2.2.10 and 2.3.x before 2.3.3 or 2.3.2-p1. A user with sitemap-generation privileges can bypass access restrictions and overwrite a subset of configuration files, enabling a denial-of-service condition. Remediation: apply the Magento security up...

CVE-2019-8131

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into code field of an inventory source...

CVE-2019-8131

CVE-2019-8131 is a stored XSS vulnerability in Magento 2.2 (pre-2.2.10) and Magento 2.3 (pre-2.3.3 or pre-2.3.2-p1). An authenticated user can inject arbitrary JavaScript into the code field of an inventory source, enabling client-side code execution. The available connected sources confirm the a...

CVE-2019-8130

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates...

CVE-2019-8130

CVE-2019-8130 affects Magento: specifically Magento 2.2.x before 2.2.10 and 2.3.x before 2.3.3 or 2.3.2-p1. The vulnerability allows a user with store manipulation privileges to execute arbitrary SQL queries by gaining access to the database connection through the email templates group instance. ...

CVE-2019-8129

Magento exposes a stored XSS vulnerability (CVE-2019-8129) affecting Magento 2.2.x before 2.2.10 and 2.3.x before 2.3.3 or 2.3.2-p1. An authenticated user can inject a payload via translation strings. Impact is described as cross-site scripting with potential credential/session risk for affected ...

CVE-2019-8129

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can exploit it by injecting an embedded expression into a translation...

CVE-2019-8128

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can exploit it by injecting malicious Javascript into the name of main website...

CVE-2019-8128

Summary: CVE-2019-8128 is a stored cross-site scripting (XSS) flaw in Magento. The vulnerability allows an authenticated user to inject malicious JavaScript into the name of the main website, affecting Magento 2.2 releases before 2.2.10 and Magento 2.3 releases before 2.3.3 or 2.3.2-p1. The issue...

CVE-2019-8127

CVE-2019-8127 is a SQL injection vulnerability in Magento Open Source: affected are Magento 2.2 up to 2.2.10 and Magento 2.3 up to 2.3.3 or 2.3.2-p1. An authenticated user with access to an account with Newsletter Template editing permission can exfiltrate the Admin login data and reset the admin...

CVE-2019-8127

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a...

CVE-2019-8126

CVE-2019-8126 describes an XML entity injection vulnerability in Magento: versions 2.2 before 2.2.10 and 2.3 before 2.3.3 (or 2.3.2-p1) allow an authenticated admin to craft a document type definition for an XML layout, enabling processing of external entities and potential information disclosure...

CVE-2019-8126

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external...

CVE-2019-8125

A remote code execution vulnerability exists in Magento 1 prior to 1.9.x and 1.14.x. An authenticated admin user can modify configuration parameters via crafted support configuration. The modification can lead to remote code execution...