CVE-2019-7940

CVE-2019-7940 is a stored cross-site scripting vulnerability in Magento products affecting multiple lines: Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. The issue arises when an au...

CVE-2019-7940

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7939

A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's...

CVE-2019-7939

Summary: CVE-2019-7939 is a reflected cross-site scripting vulnerability on Magento’s customer cart checkout page affecting Magento 2.1 (<2.1.18), 2.2 (<2.2.9), and 2.3 (

CVE-2019-7938

CVE-2019-7938 is a stored cross-site scripting vulnerability in Magento products. The issue affects Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, and Magento 2.x releases (2.1 up to 2.1.18, 2.2 up to 2.2.9, 2.3 up to 2.3.2). Affected scenario: an authenticated user wit...

CVE-2019-7938

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7937

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript...

CVE-2019-7937

Magento 2.x stored XSS vulnerability (CVE-2019-7937) exists in admin panel. Affected: Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2. Exploitation requires an authenticated user with privileges to store product attributes to inject JavaScript. Remediation: apply patch upd...

CVE-2019-7936

Summary: CVE-2019-7936 is a stored cross-site scripting (XSS) vulnerability in Magento Open Source/Commerce admin panel. Affected versions (per sources): Magento 2.1 before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2. The issue arises from insufficient validation allowing an au...

CVE-2019-7936

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript...

CVE-2019-7935

Magento CVE-2019-7935 describes a stored cross-site scripting vulnerability in the admin panel reachable by authenticated users with content-page-title privileges. Affected are Magento Open Source < 1.9.4.2 and Magento Commerce < 1.14.4.2, Magento 2.1 < 2.1.18, Magento 2.2 < 2.2.9, an...

CVE-2019-7935

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7934

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7934

CVE-2019-7934 is a stored XSS vulnerability in Magento products. An authenticated user with privileges to edit newsletter templates could inject malicious JavaScript via the admin panel. Affected versions include Magento Open Source before 1.9.4.2, Magento Commerce before 1.14.4.2, Magento 2.1 be...

CVE-2019-7932

CVE-2019-7932 describes a remote code execution in Magento Open Source <1.9.4.2, Magento Commerce <1.14.4.2, Magento 2.1 <2.1.18, 2.2 <2.2.9, or 2.3

CVE-2019-7932

A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary P...

CVE-2019-7930

Magento 2.x suffers a file upload restriction bypass (CVE-2019-7930). An authenticated admin with access to the import feature can modify a configuration file, removing upload restrictions and enabling arbitrary code execution when a malicious file is uploaded. Affected versions: Magento 2.1 <...

CVE-2019-7930

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal o...

CVE-2019-7929

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request...

CVE-2019-7929

CVE-2019-7929 describes an information-disclosure vulnerability in Magento: authenticated administrator users could view metadata of a trusted device used by another admin via a crafted HTTP request. Affected products/versions include Magento 2.1 pre-2.1.18, Magento 2.2 pre-2.2.9, and Magento 2.3...