CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-7951
https://notcve.org/view.php?id=CVE-2019-7951
02 Aug 2019 — An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests. Se presenta una vulnerabilidad de filtrado de información en Magento versiones 2.1 anteriores a 2.1.18, Magento versiones 2.2 anteriores a 2.2.9, Magento versiones 2.3 anteriores a 2.3.2. Un endpoint de servicio... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-7950
https://notcve.org/view.php?id=CVE-2019-7950
02 Aug 2019 — An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information. Se presenta una vulnerabilidad de omisión del control de acceso en Magento versiones 2.1 anteriores a 2.1.18, Magento versiones 2.2 anteriores a 2.2.9, Magento versiones 2.3 anteriores a 2.3.2. ... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-7947
https://notcve.org/view.php?id=CVE-2019-7947
02 Aug 2019 — A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Se presenta una vulnerabilidad de tipo cross-site request forgery en la funcionalidad de eliminación de GiftCardAccount para Magento Open Source anterior a versión 1.9.4.2 y Magento Commerce anterior a versión 1.14.4.2, Magento versiones 2.1 anteriores a 2... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-7945
https://notcve.org/view.php?id=CVE-2019-7945
02 Aug 2019 — A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript. Se presenta una vulnerabilidad de tipo cross-site scripting almacenado en Magento Open Source anterior a versión 1.9.4.2 y Magento Commerce anterior a versión 1.14.4.2, Magento versiones 2.1 anteri... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-7944
https://notcve.org/view.php?id=CVE-2019-7944
02 Aug 2019 — A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript. Se presenta una vulnerabilidad de tipo cross-site scripting almacenado en el campo de comentarios del producto de Magento Open Source anterior a versión 1.9.... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2019-7942
https://notcve.org/view.php?id=CVE-2019-7942
02 Aug 2019 — A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates. Se presenta una vulnerabilidad de ejecución de código remota en Magento versiones 2.1 anteriores a 2.1.18, Magento versiones 2.2 anteriores a 2.2.9, Magento versiones 2.3 anteriores a 2.3.2. Un usuario autenticado con privilegios de administrador... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 •
CVSS: 4.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-7940
https://notcve.org/view.php?id=CVE-2019-7940
02 Aug 2019 — A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify store currency options to inject malicious javascript. Se presenta una vulnerabilidad de tipo cross-site scripting almacenado en el panel de administración de Magento Open Source anterior a versión 1.9... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-7939
https://notcve.org/view.php?id=CVE-2019-7939
02 Aug 2019 — A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser. Se presenta una vulnerabilidad de tipo cross-site scripting reflejada en la página de pago del carrito del cliente de Magento versiones 2.1 anteriores a 2.1.18, Magento versiones 2.2 anteriores a 2.2.9, Ma... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-7938
https://notcve.org/view.php?id=CVE-2019-7938
02 Aug 2019 — A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript. Se presenta una vulnerabilidad de tipo cross-site scripting almacenado en el panel de administración de Magento Open Source anterior a versión 1.9.4.... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-7937
https://notcve.org/view.php?id=CVE-2019-7937
02 Aug 2019 — A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript. Se presenta una vulnerabilidad de tipo cross-site scripting almacenado en el panel de administración de Magento versiones 2.1 anteriores a 2.1.18, Magento versiones 2.2 anteriores a 2.2.9, Magento versiones 2.3 anteriores a 2.3.2... • https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •