CVE-2019-7877

The CVE-2019-7877 entry details a stored cross-site scripting (XSS) vulnerability in Magento 2.x. An authenticated user with privileges to manage orders can inject malicious JavaScript via the admin panel in Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7876

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout...

CVE-2019-7876

CVE-2019-7876 is a remote code execution vulnerability in Magento 2.x prior to certain patch levels: 2.1.x < 2.1.18, 2.2.x < 2.2.9, and 2.3.x

CVE-2019-7875

CVE-2019-7875 is a stored cross-site scripting vulnerability in Magento’s admin panel that could be triggered by an authenticated user with privileges to the newsletter templates. Affected products/versions include Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, and Mage...

CVE-2019-7875

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7874

CVE-2019-7874 affects Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7874

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles...

CVE-2019-7873

CVE-2019-7873 is a cross-site request forgery vulnerability in Magento 2.1 (before 2.1.18), 2.2 (before 2.2.9), and 2.3 (before 2.3.2) that can cause unintended deletion of the store design schedule. Affected versions are exposed publicly; exploitation details are not provided in the documents, b...

CVE-2019-7873

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule...

CVE-2019-7872

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing us...

CVE-2019-7872

CVE-2019-7872 affects Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7871

Magento 2.x contains a security bypass that enables arbitrary PHP code execution via form data injection. Affected versions are 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. The root cause is a bypass of protections that prevent arbitrary PHP script upload, exploitable by an authenti...

CVE-2019-7871

A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection...

CVE-2019-7869

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups...

CVE-2019-7869

Magento 2.x stores a stored XSS in the admin panel, exploitable by an authenticated user with permission to manage customer groups. Affected versions: 2.1.x before 2.1.18, 2.2.x before 2.2.9, 2.3.x before 2.3.2. Remediation: apply the security updates released for these branches (e.g., Magento 2....

CVE-2019-7868

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules...

CVE-2019-7868

Magento 2: A stored cross-site scripting (XSS) vulnerability exists in the admin panel for Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. It can be exploited by an authenticated user who has permissions to manage tax rules. Impact details in the connected Red Hat advisory conf...

CVE-2019-7867

CVE-2019-7867 : A stored cross-site scripting vulnerability exists in the Magento Admin Panel. Affected: Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. Exploitation requires an authenticated user with access to manage orders and order status. Root cause: ...

CVE-2019-7867

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...