Remote code execution

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout...

CVE-2019-7896

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout...

CVE-2019-7896

CVE-2019-7896 affects Magento versions prior to 2.1.18 (2.1.x), 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2. The flaw allows an authenticated administrator with access to layouts to execute arbitrary code via a combination of product import, a crafted CSV file, and an XML layout update, resulting ...

CVE-2019-7895

Summary: Magento 2.x versions are affected by a remote code execution vulnerability via a crafted XML layout update. Affected versions: 2.1 before 2.1.18, 2.2 before 2.2.9, 2.3 before 2.3.2. Prerequisite to exploit: an authenticated user with admin privileges to layouts. Impact: arbitrary code ex...

CVE-2019-7876

CVE-2019-7876 is a remote code execution vulnerability in Magento 2.x prior to certain patch levels: 2.1.x < 2.1.18, 2.2.x < 2.2.9, and 2.3.x

CVE-2019-7876

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout...

CVE-2019-7876

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout...

CVE-2019-7896: Undefined Security Weakness

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout...

CVE-2019-7895: Undefined Security Weakness

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update...

PT-2019-18800

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A remote code execution issue exists, allowing an authenticated user with layout manipulation privileges to insert a...

CVE-2019-7942: Undefined Security Weakness

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates...

PT-2019-18843

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A remote code execution issue exists, allowing an authenticated user with admin privileges to execute arbitrary code via...

PT-2019-18812

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A remote code execution issue exists, allowing an authenticated user with admin privileges to layouts to execute arbitrary...

PT-2019-18813

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Description A remote code execution issue exists, allowing an authenticated user with administrator privileges to layouts to execute...

CVE-2019-7876: Undefined Security Weakness

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout...

Clop Ransomware

ARCHIVED STORY Clop Ransomware Alexandre Mundo · AUG 01, 2019 This new ransomware was discovered by Michael Gillespie on 8 February 2019 and it is still improving over time. This blog will explain the technical details and share information about how this new ransomware family is working. There a...

USN-4081-1: Pango vulnerability

It was discovered that Pango incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...

CVE-2019-2241

While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI behaviour in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer...

Design/Logic Flaw

While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI behaviour in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer...

PT-2019-16319

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions MDM9150 through MDM9655 Qualcomm Snapdragon Compute versions MDM9150 through MDM9655 Qualcomm Snapdragon Connectivity versions MDM9150 through MDM9655 Qualcomm Snapdragon Consumer Electronics Connectivity...