CVE-2019-8149

CVE-2019-8149 affects Magento: insecure authentication and session management in Magento 2.2 < 2.2.10 and Magento 2.3

CVE-2019-8148

CVE-2019-8148 affects Magento 2.3 up to versions prior to 2.3.3 or 2.3.2-p1. The vulnerability is a stored cross-site scripting (XSS) flaw where an authenticated admin user can inject arbitrary JavaScript code when creating a content page via the page builder. This could result in script executio...

CVE-2019-8148

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder...

CVE-2019-8147

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via customer attribute label...

CVE-2019-8147

The CVE-2019-8147 entry describes a stored XSS vulnerability in Magento 2.x (before 2.2.10 and before 2.3.3 or 2.3.2-p1). An authenticated user can inject arbitrary JavaScript via a customer attribute label, enabling script execution in affected users’ browsers. Connected sources corroborate this...

CVE-2019-8146

CVE-2019-8146 is a stored cross-site scripting (XSS) flaw in Magento: affected are Magento 2.2 versions before 2.2.10 and Magento 2.3 versions before 2.3.3 or 2.3.2-p1. The vulnerability allows an authenticated user to inject arbitrary JavaScript when adding a new customer attribute for stores. T...

CVE-2019-8146

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores...

CVE-2019-8144

A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods...

CVE-2019-8144

Magento 2.3 (before 2.3.3 or 2.3.2-p1) is affected by a remote code execution vulnerability via PageBuilder template methods. An unauthenticated attacker can supply a payload to achieve RCE. Mitigation is to apply the Magento security patch 2.3.3 (and 2.2.10) as cited in security advisories; no e...

CVE-2019-8143

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database...

CVE-2019-8143

CVE-2019-8143 affects Magento: Magento 2.2 versions before 2.2.10 and Magento 2.3 versions before 2.3.3 or 2.3.2-p1 are vulnerable. An authenticated user with access to email templates can issue malicious SQL queries to access sensitive data. Remediation: upgrade to Magento 2.2.10 or 2.3.3 (or ne...

CVE-2019-8142

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via title of an order when configuring sales payment methods for a store...

CVE-2019-8142

CVE-2019-8142 is a stored XSS vulnerability affecting Magento 2.2 (before 2.2.10) and Magento 2.3 (before 2.3.3 or 2.3.2-p1). An authenticated user can inject arbitrary JavaScript via the order title when configuring sales payment methods. The issue is triggered in the merchant-facing configurati...

CVE-2019-8141

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges system level import can execute arbitrary code through a Phar deserialization vulnerability in the import...

CVE-2019-8141

CVE-2019-8141 affects Magento open-source platforms Magento 2.1 (before 2.1.19), Magento 2.2 (before 2.2.10), and Magento 2.3 (before 2.3.3). The issue is a remote code execution via a Phar deserialization vulnerability in the system-level import functionality, exploitable by an authenticated use...

CVE-2019-8140

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file...

CVE-2019-8140

CVE-2019-8140 affects Magento 2.x: versions prior to 2.2.10 (and 2.3 prior to 2.3.3 or 2.3.2-p1) are vulnerable. An authenticated admin can exploit the Media File Storage Synchronization to convert uploaded JPEGs into PHP files, enabling unrestricted file upload. Root cause: improper handling in ...

CVE-2019-8139

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product...

CVE-2019-8139

Magento 2.3.x prior to 2.3.3 or 2.3.2-p1 is affected by a stored XSS in the Page Builder dynamic block, exploitable by an authenticated user. The issue stems from arbitrary JavaScript injection into product pages. The recommended remediation is applying the Magento security patch in versions 2.3....

CVE-2019-8138

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event...