Cross site scripting

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript...

Cross site scripting

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript...

Cross site scripting

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

Cross site scripting

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7940

CVE-2019-7940 is a stored cross-site scripting vulnerability in Magento products affecting multiple lines: Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2. The issue arises when an au...

CVE-2019-7940

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7938

CVE-2019-7938 is a stored cross-site scripting vulnerability in Magento products. The issue affects Magento Open Source prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, and Magento 2.x releases (2.1 up to 2.1.18, 2.2 up to 2.2.9, 2.3 up to 2.3.2). Affected scenario: an authenticated user wit...

CVE-2019-7937

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript...

CVE-2019-7937

Magento 2.x stored XSS vulnerability (CVE-2019-7937) exists in admin panel. Affected: Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2. Exploitation requires an authenticated user with privileges to store product attributes to inject JavaScript. Remediation: apply patch upd...

CVE-2019-7936

Summary: CVE-2019-7936 is a stored cross-site scripting (XSS) vulnerability in Magento Open Source/Commerce admin panel. Affected versions (per sources): Magento 2.1 before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2. The issue arises from insufficient validation allowing an au...

CVE-2019-7935

Magento CVE-2019-7935 describes a stored cross-site scripting vulnerability in the admin panel reachable by authenticated users with content-page-title privileges. Affected are Magento Open Source < 1.9.4.2 and Magento Commerce < 1.14.4.2, Magento 2.1 < 2.1.18, Magento 2.2 < 2.2.9, an...

CVE-2019-7934

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7934

CVE-2019-7934 is a stored XSS vulnerability in Magento products. An authenticated user with privileges to edit newsletter templates could inject malicious JavaScript via the admin panel. Affected versions include Magento Open Source before 1.9.4.2, Magento Commerce before 1.14.4.2, Magento 2.1 be...

CVE-2019-7927

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript...

CVE-2019-7927

CVE-2019-7927 is a stored cross-site scripting (XSS) vulnerability in Magento admin panel. The Red Hat and related advisories confirm that authenticated users with privileges to edit product content pages can inject malicious JavaScript. Affected releases are Magento 2.1.x before 2.1.18, Magento ...

CVE-2019-7926

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript...

CVE-2019-7911

A server-side request forgery SSRF vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin pan...

CVE-2019-7911

CVE-2019-7911 is a server-side request forgery (SSRF) affecting Magento products: Open Source before 1.9.4.2, Commerce before 1.14.4.2, and Magento 2.x before 2.1.18, 2.2.9, 2.3.2. An authenticated admin can manipulate system configuration and execute arbitrary code. Remediation per sources is to...

CVE-2019-7909

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with...

CVE-2019-7909

CVE-2019-7909 is a stored cross-site scripting (XSS) vulnerability in Magento’s admin panel that affects multiple product lines: Magento Open Source <1.9.4.2, Magento Commerce <1.14.4.2, and Magento 2.x across 2.1 <2.1.18, 2.2 <2.2.9, and 2.3