CVE-2019-8125

Magento 1 (prior to 1.9.x and 1.14.x) is affected by a remote code execution vulnerability that an authenticated admin can trigger by modifying configuration parameters through a crafted support configuration. This is supported by multiple CVE references in the provided documents and lists SUPEE-...

CVE-2019-8124

Magento 2.x contains an insufficient logging and monitoring vulnerability (CVE-2019-8124) where admin actions related to design configuration are not tracked, enabling repudiation risks. Affected versions: Magento 2.1 before 2.1.19, Magento 2.2 before 2.2.10, and Magento 2.3 before 2.3.3. Remedia...

CVE-2019-8124

An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to track admin actions related to design configuration could lead to repudiation attacks...

CVE-2019-8123

CVE-2019-8123 affects Magento products across multiple lines: Magento 1.x (before 1.9.4.3 and 1.14.4.3) and Magento 2.x (2.1 before 2.1.19, 2.2 before 2.2.10, 2.3 before 2.3.3). The issue is an insufficient logging and monitoring vulnerability where the logging feature lacks enough data to effect...

CVE-2019-8123

An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track...

CVE-2019-8122

CVE-2019-8122 - Magento RCE . A remote code execution vulnerability exists in Magento 2.1 before 2.1.19, 2.2 before 2.2.10, and 2.3 before 2.3.3. An authenticated user with privileges to create products can craft a custom layout update and, via the import product function, trigger RCE. The root c...

CVE-2019-8122

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with privileges to create products can craft custom layout update and use import product functionality to enable remote code execution...

CVE-2019-8121

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries Bootstrap, jquery, Knockout with known security vulnerabilities...

CVE-2019-8121

CVE-2019-8121 affects Magento 2.x prior to the listed fixes: 2.1 before 2.1.19, 2.2 before 2.2.10, and 2.3 before 2.3.3. The issue arises from Magento’s codebase using outdated JS libraries (Bootstrap, jQuery, Knockout) with known vulnerabilities. The documented impact is high/critical, and remed...

CVE-2019-8120

A stored cross-site scripting XSS vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address...

CVE-2019-8120

Affected product: Magento. The CVE-2019-8120 vulnerability is a stored XSS in Magento 2.x prior to 2.1.19, 2.2 prior to 2.2.10, and 2.3 prior to 2.3.3. An authenticated user can inject arbitrary JavaScript by manipulating a POST request field related to the customer’s email address. Impact: clien...

CVE-2019-8119

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these...

CVE-2019-8119

CVE-2019-8119 affects Magento: Magento 2.1 up to 2.1.18, Magento 2.2 up to 2.2.9, and Magento 2.3 up to 2.3.2 are vulnerable. An authenticated admin with import product privileges can delete files via bulk product import and inject code into an XSLT file, enabling remote code execution. This is a...

CVE-2019-8118

Summary: CVE-2019-8118 affects Magento 2.1 (pre-2.1.19), 2.2 (pre-2.2.10), and 2.3 (pre-2.3.3) where failed login attempts for customer accounts are stored using a weak cryptographic function. Impact (as described): The vulnerability arises from the weak crypto used for storing failed login attem...

CVE-2019-8118

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts...

CVE-2019-8117

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification...

CVE-2019-8117

CVE-2019-8117 is a stored cross-site scripting (XSS) vulnerability in Magento. It affects Magento 2.2 up to but not including 2.2.10 and Magento 2.3 up to but not including 2.3.3 (or 2.3.2-p1). An authenticated user can inject arbitrary JavaScript via the product view id specification. No exploit...

CVE-2019-8116

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a guest session id value following a successful login to gain access to customer account index page...

CVE-2019-8116

CVE-2019-8116 is an insecure authentication and session management vulnerability in Magento. Affected products: Magento 2.2 before 2.2.10 and Magento 2.3 before 2.3.3 (or 2.3.2-p1). An unauthenticated user can leverage a guest session ID after login to access the customer account index page. This...

CVE-2019-8115

CVE-2019-8115 is a reflected XSS vulnerability in Magento Magento 2.2 (before 2.2.10) and 2.3 (before 2.3.3 or 2.3.2-p1). An authenticated admin can inject arbitrary JavaScript when adding an image during simple product creation. Root cause: input reflected in the image-attachment flow allows scr...