CVE-2019-7892

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery...

CVE-2019-7892

Magento exposes a remote code execution vulnerability in 2.1.x before 2.1.18, 2.2.x before 2.2.9, and 2.3.x before 2.3.2. An authenticated administrator who can access shipment settings can trigger SSRF to execute arbitrary code on the server. Documented in multiple sources (including Red Hat and...

CVE-2019-7890

CVE-2019-7890 is an IDOR in Magento’s order processing workflow affecting 2.1.x before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. This could allow unauthorized access to order details. The NVD/Red Hat/OSV entries confirm a high-severity, network-exposed vulnerability with no required user pr...

CVE-2019-7890

An Insecure Direct Object Reference IDOR vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7889

CVE-2019-7889 is an injection vulnerability in Magento Open Source before 1.9.4.2, Commerce before 1.14.4.2, and Magento 2.x prior to 2.1.18, 2.2.x prior to 2.2.9, or 2.3.x prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that modify the underlying m...

CVE-2019-7889

An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data o...

CVE-2019-7888

An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template...

CVE-2019-7888

CVE-2019-7888 affects Magento 2.1 (before 2.1.18), 2.2 (before 2.2.9), and 2.3 (before 2.3.2). An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template. The connected sources corroborate the vulnerability description and list vendor-...

CVE-2019-7887

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is...

CVE-2019-7887

CVE-2019-7887 is a reflected cross-site scripting vulnerability in the Magento family admin panels when the Admin URL secret key feature is disabled. Affected products and versions include Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magen...

CVE-2019-7886

A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts...

CVE-2019-7886

CVE-2019-7886 affects Magento 2.1.x before 2.1.18, 2.2.x before 2.2.9, and 2.3.x before 2.3.2. The issue is a weak cryptographic mechanism used to generate the initialization vector in multiple security contexts, enabling potential cryptographic abuse. RedHat and OSV listings confirm the same des...

CVE-2019-7885

CVE-2019-7885 affects Magento: insufficient input validation in the Elastic Search module config builder allows authenticated users with catalog search config rights to trigger remote code execution. Impact is described as RCE in Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7885

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

CVE-2019-7882

CVE-2019-7882 is a stored XSS vulnerability in Magento’s WYSIWYG editor across multiple release lines. Affected products include Magento Open Source before 1.9.4.2, Magento Commerce before 1.14.4.2, and Magento 2 series: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated ...

CVE-2019-7882

A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can...

CVE-2019-7881

Magento 2.x suffers a cross-site scripting mitigation bypass in versions: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated admin could exploit this to escalate privileges (admin vs admin XSS). Remediation per sources: apply the Magento security update for 2.1.18, 2.2.9,...

CVE-2019-7881

A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges admin vs. admin XSS attack...

CVE-2019-7880

Summary: CVE-2019-7880 is a stored XSS vulnerability in Magento admin panels. The issue affects Magento 2.1 (< 2.1.18), 2.2 (< 2.2.9), and 2.3 (

CVE-2019-7880

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript...