4381 matches found
CVE-2019-7868
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules...
CVE-2019-7868
Magento 2: A stored cross-site scripting (XSS) vulnerability exists in the admin panel for Magento 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. It can be exploited by an authenticated user who has permissions to manage tax rules. Impact details in the connected Red Hat advisory conf...
CVE-2019-7867
CVE-2019-7867 : A stored cross-site scripting vulnerability exists in the Magento Admin Panel. Affected: Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. Exploitation requires an authenticated user with access to manage orders and order status. Root cause: ...
CVE-2019-7867
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status...
CVE-2019-7866
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...
CVE-2019-7866
Magento 2.x suffers a stored XSS in the admin panel, affecting 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated user with access to edit product information via the TinyMCE editor can exploit it. Root cause: lack of input sanitization in admin product editing flow. Impa...
CVE-2019-7865
A cross-site request forgery CSRF vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration...
CVE-2019-7865
CVE-2019-7865 - Magento CSRF in checkout cart item. A CSRF vulnerability exists in Magento 2.1.x before 2.1.18, 2.2.x before 2.2.9, and 2.3.x before 2.3.2, exploitable during editing/configuration of checkout cart items. The issue stems from inadequate CSRF protections on the checkout cart item w...
CVE-2019-7864
CVE-2019-7864 describes an insecure direct object reference (IDOR) in Magento’s RSS feeds. Affected products are Magento 2.1 releases before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2, where RSS feed requests could expose order details to unauthorized users. The Red Hat and OS...
CVE-2019-7864
An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...
CVE-2019-7863
A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories...
CVE-2019-7863
A stored cross-site scripting vulnerability exists in the Magento admin panel affecting Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. The issue can be exploited by an authenticated user with access to products and categories, due to the underlying XSS in...
CVE-2019-7862
Magento 2.x Reflected XSS in Product widget chooser (admin) affects: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. Root cause: reflected cross-site scripting in the admin panel’s Product widget chooser. Impact: as described, enabling an attacker to inject scripts via user input durin...
CVE-2019-7862
A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
CVE-2019-7861
Magento 2.x prior to updates 2.1.18, 2.2.x prior to 2.2.9, and 2.3.x prior to 2.3.2 are affected by insufficient server-side validation of user input that can bypass file upload restrictions. The root cause is improper input validation during upload, enabling attackers to upload malicious files. ...
CVE-2019-7861
Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
CVE-2019-7860
Magento 2.x releases before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2 are affected by a cryptographically weak PRNG used in security-relevant contexts. The root cause is insufficient randomness in generation routines across multiple components, which can undermine cryptographic operations an...
CVE-2019-7860
A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...
CVE-2019-7859
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control...