4298 matches found
CVE-2019-7929
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request...
CVE-2019-7929
CVE-2019-7929 describes an information-disclosure vulnerability in Magento: authenticated administrator users could view metadata of a trusted device used by another admin via a crafted HTTP request. Affected products/versions include Magento 2.1 pre-2.1.18, Magento 2.2 pre-2.2.9, and Magento 2.3...
CVE-2019-7928
A denial-of-service DoS vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol, an unauthenticated attacker could disrupt transactions between the Magento merchant a...
CVE-2019-7928
CVE-2019-7928 is a DoS vulnerability in Magento with affected versions: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. The issue arises from abusing insufficient brute-forcing defenses in the token exchange with PayPal, allowing an unauthenticated attacker to disrupt transactions betw...
CVE-2019-7927
CVE-2019-7927 is a stored cross-site scripting (XSS) vulnerability in Magento admin panel. The Red Hat and related advisories confirm that authenticated users with privileges to edit product content pages can inject malicious JavaScript. Affected releases are Magento 2.1.x before 2.1.18, Magento ...
CVE-2019-7927
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript...
CVE-2019-7926
CVE-2019-7926 is a stored cross-site scripting vulnerability in Magento’s admin panel. Affected Magento versions are 2.1.x before 2.1.18, 2.2.x before 2.2.9, and 2.3.x before 2.3.2. The issue can be exploited by an authenticated user with privileges to modify node attributes to inject malicious J...
CVE-2019-7926
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript...
CVE-2019-7925
CVE-2019-7925 describes an insecure direct object reference (IDOR) in Magento 2.1.x/2.2.x/2.3.x prior to 2.1.18, 2.2.9, 2.3.2, respectively. An administrator with limited privileges can delete the downloadable products folder. Root cause: IDOR in the handling of downloadable product folders. Impa...
CVE-2019-7925
An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder...
CVE-2019-7923
A server-side request forgery SSRF vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code...
CVE-2019-7923
CVE-2019-7923 is an SSRF vulnerability in Magento 2.x prior to patch versions: 2.1.18, 2.2.9, and 2.3.2. It can be exploited by an authenticated admin to manipulate shipment settings and execute arbitrary code. Affected products are Magento 2.1, 2.2, and 2.3 branches with the vulnerability descri...
CVE-2019-7921
Magento 2.x cross-site scripting vulnerability CVE-2019-7921 affects the product catalog form and can be exploited by an authenticated user with catalog privileges to inject JavaScript. Affected versions are Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. The issue is fixed by ...
CVE-2019-7921
A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript...
CVE-2019-7915
A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers...
CVE-2019-7915
The CVE-2019-7915 issue affects Magento Open Source (Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2). Under certain conditions, an unauthenticated attacker can cause the Magento full page cache to serve a 404 page to customers, constituting a denial-of-service that impact...
CVE-2019-7913
CVE-2019-7913 is a server-side request forgery (SSRF) in Magento. Affected are Magento 2.1 before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2. The vulnerability can be exploited by an authenticated user with admin privileges to manipulate shipment methods and execute arbitrary ...
CVE-2019-7913
A server-side request forgery SSRF vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code...
CVE-2019-7912
A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious uploa...