4415 matches found
CVE-2019-8092
Magento 2.x suffers a reflected XSS via email template preview. Affected: Magento 2.2 before 2.2.10; Magento 2.3 before 2.3.3 or 2.3.2-p1. Exploitation requires an authenticated user. Impact: allows injection of arbitrary JavaScript in the user’s context. Remediation: apply security update (2.2.1...
CVE-2019-8092
A reflected cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview...
CVE-2019-8090
An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature...
CVE-2019-8090
CVE-2019-8090 affects Magento Open Source versions: 2.1.x before 2.1.19, 2.2.x before 2.2.10, and 2.3.x before 2.3.3. An authenticated user can manipulate the design layout update feature to cause arbitrary file deletion. Mitigation: apply the security updates that fix these branches (2.1.19, 2.2...
Magecart Groups Attack Simultaneous Sites in Card-Theft Frenzy
In an interesting development on the financial cybercrime scene, different Magecart groups have been spotting stepping over each other and attacking the same sites. Magecart is an umbrella term encompassing several different threat groups who all use the same modus operandi: They compromise...
CVE-2019-8235
An insecure direct object reference IDOR vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled...
CVE-2019-8235
An insecure direct object reference IDOR vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled...
Input validation
An insecure direct object reference IDOR vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled...
CVE-2019-8235
CVE-2019-8235 is an IDOR vulnerability affecting Magento 2.x—specifically versions prior to 2.3.1 (2.3.x), 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17. An authenticated user could view another user’s personally identifiable shipping details due to insufficient validation of user-controlled input....
CVE-2019-8235
An insecure direct object reference IDOR vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled...
Magento Input Validation Error Vulnerability (CNVD-2019-44999)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. An input validation error vulnerability exists in Magento versions 2.3.1 before 2.3, 2.2.8 before 2.2, and 2.1.17...
Magento Cacheleak
Magento 1 cache files are stored in the public directory of Magento installation. Misconfigured authorisation for /var directory has been detected. As cache filenames can be predicted they could be accessed and then exposed critical information like database login/password for example. No source...
Magento Arbitrary File Deletion Vulnerability (CNVD-2019-35412)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento arbitrary file deletion vulnerability , an attacker can use the vulnerability to delete arbitrary files...
Magento Remote Code Execution Vulnerability
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A remote code execution vulnerability exists in Magento Open Source versions prior to 1.9.4.3 and Magento Commerc...
Magento Arbitrary File Deletion Vulnerability
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento arbitrary file deletion vulnerability , an attacker can use the vulnerability to delete arbitrary files...
Magento Information Disclosure Vulnerability (CNVD-2019-35415)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento in the information leakage vulnerability , an attacker can exploit the vulnerability to read / delete...
Magento cross-site scripting vulnerability (CNVD-2019-34460)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the...
Magento cross-site scripting vulnerability (CNVD-2019-34461)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the...
Magento Information Disclosure Vulnerability (CNVD-2019-36993)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. An information disclosure vulnerability exists in Magento Open Source versions prior to 1.9.4.3 and Magento...
