4415 matches found
CVE-2019-8123
An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track...
CVE-2019-8122
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with privileges to create products can craft custom layout update and use import product functionality to enable remote code execution...
CVE-2019-8122
CVE-2019-8122 - Magento RCE . A remote code execution vulnerability exists in Magento 2.1 before 2.1.19, 2.2 before 2.2.10, and 2.3 before 2.3.3. An authenticated user with privileges to create products can craft a custom layout update and, via the import product function, trigger RCE. The root c...
CVE-2019-8121
CVE-2019-8121 affects Magento 2.x prior to the listed fixes: 2.1 before 2.1.19, 2.2 before 2.2.10, and 2.3 before 2.3.3. The issue arises from Magento’s codebase using outdated JS libraries (Bootstrap, jQuery, Knockout) with known vulnerabilities. The documented impact is high/critical, and remed...
CVE-2019-8121
An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries Bootstrap, jquery, Knockout with known security vulnerabilities...
CVE-2019-8120
A stored cross-site scripting XSS vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address...
CVE-2019-8120
Affected product: Magento. The CVE-2019-8120 vulnerability is a stored XSS in Magento 2.x prior to 2.1.19, 2.2 prior to 2.2.10, and 2.3 prior to 2.3.3. An authenticated user can inject arbitrary JavaScript by manipulating a POST request field related to the customer’s email address. Impact: clien...
CVE-2019-8119
CVE-2019-8119 affects Magento: Magento 2.1 up to 2.1.18, Magento 2.2 up to 2.2.9, and Magento 2.3 up to 2.3.2 are vulnerable. An authenticated admin with import product privileges can delete files via bulk product import and inject code into an XSLT file, enabling remote code execution. This is a...
CVE-2019-8119
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these...
CVE-2019-8118
Summary: CVE-2019-8118 affects Magento 2.1 (pre-2.1.19), 2.2 (pre-2.2.10), and 2.3 (pre-2.3.3) where failed login attempts for customer accounts are stored using a weak cryptographic function. Impact (as described): The vulnerability arises from the weak crypto used for storing failed login attem...
CVE-2019-8118
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts...
CVE-2019-8117
CVE-2019-8117 is a stored cross-site scripting (XSS) vulnerability in Magento. It affects Magento 2.2 up to but not including 2.2.10 and Magento 2.3 up to but not including 2.3.3 (or 2.3.2-p1). An authenticated user can inject arbitrary JavaScript via the product view id specification. No exploit...
CVE-2019-8117
A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification...
CVE-2019-8116
CVE-2019-8116 is an insecure authentication and session management vulnerability in Magento. Affected products: Magento 2.2 before 2.2.10 and Magento 2.3 before 2.3.3 (or 2.3.2-p1). An unauthenticated user can leverage a guest session ID after login to access the customer account index page. This...
CVE-2019-8116
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a guest session id value following a successful login to gain access to customer account index page...
CVE-2019-8115
A reflected cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation...
CVE-2019-8115
CVE-2019-8115 is a reflected XSS vulnerability in Magento Magento 2.2 (before 2.2.10) and 2.3 (before 2.3.3 or 2.3.2-p1). An authenticated admin can inject arbitrary JavaScript when adding an image during simple product creation. Root cause: input reflected in the image-attachment flow allows scr...
CVE-2019-8114
Summary: CVE-2019-8114 is a remote code execution vulnerability affecting Magento 1 (up to 1.9.4.3 and 1.14.4.3) and Magento 2 (2.2 up to 2.2.10; 2.3 up to 2.3.3 or 2.3.2-p1). An authenticated admin can inject arbitrary code by uploading a crafted configuration archive file via the admin import f...
CVE-2019-8114
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload...