CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7865

A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...

CVE-2019-7865

CVE-2019-7865 - Magento CSRF in checkout cart item. A CSRF vulnerability exists in Magento 2.1.x before 2.1.18, 2.2.x before 2.2.9, and 2.3.x before 2.3.2, exploitable during editing/configuration of checkout cart items. The issue stems from inadequate CSRF protections on the checkout cart item w...

CVE-2019-7864

CVE-2019-7864 describes an insecure direct object reference (IDOR) in Magento’s RSS feeds. Affected products are Magento 2.1 releases before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2, where RSS feed requests could expose order details to unauthorized users. The Red Hat and OS...

CVE-2019-7864

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7863

A stored cross-site scripting vulnerability exists in the Magento admin panel affecting Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. The issue can be exploited by an authenticated user with access to products and categories, due to the underlying XSS in...

CVE-2019-7863

A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories...

CVE-2019-7862

Magento 2.x Reflected XSS in Product widget chooser (admin) affects: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. Root cause: reflected cross-site scripting in the admin panel’s Product widget chooser. Impact: as described, enabling an attacker to inject scripts via user input durin...

CVE-2019-7862

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7861

Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7861

Magento 2.x prior to updates 2.1.18, 2.2.x prior to 2.2.9, and 2.3.x prior to 2.3.2 are affected by insufficient server-side validation of user input that can bypass file upload restrictions. The root cause is improper input validation during upload, enabling attackers to upload malicious files. ...

CVE-2019-7860

Magento 2.x releases before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2 are affected by a cryptographically weak PRNG used in security-relevant contexts. The root cause is insufficient randomness in generation routines across multiple components, which can undermine cryptographic operations an...

CVE-2019-7860

A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7859

CVE-2019-7859 describes a path-traversal vulnerability in the Magento WYSIWYG editor affecting Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7859

A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control...

CVE-2019-7858

A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks...

CVE-2019-7858

CVE-2019-7858 relates to a cryptographic flaw in Magento where storage of sensitive information used an algorithm not sufficiently resistant to brute-force attacks. Affected products/versions: Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. Impact is the p...

CVE-2019-7857

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation...

CVE-2019-7857

CVE-2019-7857 affects Magento 2.x: Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2 are vulnerable to CSRF due to an insufficient anti-CSRF token implementation, allowing manipulation that can add items to a shopper’s cart. Root cause is weak CSRF protection in the checkout/cart ...

CVE-2019-7855

CVE-2019-7855 affects Magento platforms: Magento 2.1 before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2. Description: a cryptographic flaw could be exploited by an unauthenticated user to discover an invariant used in gift card generation. This is a cryptographic weakness rathe...