Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-7871 State: PUBLISHED Published: 2019-08-02T21:17:01 Last Updated: 2024-08-04T21:02:18.955Z Vendors: n/a Products: Magento 2 Problem Types: Arbitrary PHP Code Execution Description: A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7872 State: PUBLISHED Published: 2019-08-02T21:17:31 Last Updated: 2024-08-04T21:02:19.167Z Vendors: n/a Products: Magento 2 Problem Types: Insecure Direct Object Reference Description: An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7873 State: PUBLISHED Published: 2019-08-02T21:17:53 Last Updated: 2024-08-04T21:02:19.065Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Request Forgery Description: A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE ID: CVE-2019-7874 State: PUBLISHED Published: 2019-08-02T21:18:13 Last Updated: 2024-08-04T21:02:19.151Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Request Forgery Description: A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7875 State: PUBLISHED Published: 2019-08-02T21:18:32 Last Updated: 2024-08-04T21:02:18.990Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7876 State: PUBLISHED Published: 2019-08-02T21:18:53 Last Updated: 2024-08-04T21:02:18.960Z Vendors: n/a Products: Magento 2 Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7877 State: PUBLISHED Published: 2019-08-02T21:19:17 Last Updated: 2024-08-04T21:02:18.973Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7880 State: PUBLISHED Published: 2019-08-02T21:19:44 Last Updated: 2024-08-04T21:02:19.023Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7881 State: PUBLISHED Published: 2019-08-02T21:20:04 Last Updated: 2024-08-04T21:02:19.231Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack). Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7882 State: PUBLISHED Published: 2019-08-02T21:20:29 Last Updated: 2024-08-04T21:02:19.015Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7885 State: PUBLISHED Published: 2019-08-02T21:20:53 Last Updated: 2024-08-04T21:02:19.254Z Vendors: n/a Products: Magento 2 Problem Types: Remote Code Execution Description: Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7886 State: PUBLISHED Published: 2019-08-02T21:21:15 Last Updated: 2024-08-04T21:02:19.243Z Vendors: n/a Products: Magento 2 Problem Types: Cryptographic Flaw Description: A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE ID: CVE-2019-7887 State: PUBLISHED Published: 2019-08-02T21:21:40 Last Updated: 2024-08-04T21:02:19.044Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Cross-Site Scripting Description: A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7888 State: PUBLISHED Published: 2019-08-02T21:22:00 Last Updated: 2024-08-04T21:02:19.005Z Vendors: n/a Products: Magento 2 Problem Types: Information Disclosure Description: An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE ID: CVE-2019-7889 State: PUBLISHED Published: 2019-08-02T21:22:30 Last Updated: 2024-08-04T21:02:19.207Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Injection Description: An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-securit
otes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7890 State: PUBLISHED Published: 2019-08-02T21:22:50 Last Updated: 2024-08-04T21:02:19.001Z Vendors: n/a Products: Magento 2 Problem Types: Insecure Direct Object Reference Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7892 State: PUBLISHED Published: 2019-08-02T21:23:08 Last Updated: 2024-08-04T21:02:19.121Z Vendors: n/a Products: Magento 2 Problem Types: Server-side Request Forgery Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7895 State: PUBLISHED Published: 2019-08-02T21:23:27 Last Updated: 2024-08-04T21:02:18.963Z Vendors: n/a Products: Magento 2 Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7896 State: PUBLISHED Published: 2019-08-02T21:23:46 Last Updated: 2024-08-04T21:02:18.988Z Vendors: n/a Products: Magento 2 Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7897 State: PUBLISHED Published: 2019-08-02T21:24:04 Last Updated: 2024-08-04T21:02:19.263Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to customer configurations to inject malicious javascript. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-securi
Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7898 State: PUBLISHED Published: 2019-08-02T21:24:28 Last Updated: 2024-08-04T21:02:18.974Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Information Leakage Description: Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7899 State: PUBLISHED Published: 2019-08-02T21:24:47 Last Updated: 2024-08-04T21:02:19.024Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Information Leakage Description: Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE ID: CVE-2019-7903 State: PUBLISHED Published: 2019-08-02T21:25:07 Last Updated: 2024-08-04T21:02:19.154Z Vendors: n/a Products: Magento 2 Problem Types: Remote Code Execution Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7904 State: PUBLISHED Published: 2019-08-02T21:25:26 Last Updated: 2024-08-04T21:02:19.397Z Vendors: n/a Products: Magento 2 Problem Types: Access Control Bypass Description: Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7908 State: PUBLISHED Published: 2019-08-02T21:25:53 Last Updated: 2024-08-04T21:02:19.247Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify product information. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7909 State: PUBLISHED Published: 2019-08-02T21:26:16 Last Updated: 2024-08-04T21:02:19.161Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7911 State: PUBLISHED Published: 2019-08-02T21:26:37 Last Updated: 2024-08-04T21:02:19.170Z Vendors: n/a Products: Magento 1 Magento 2 Problem Types: Server-side Request Forgery Description: A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2
nal Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7912 State: PUBLISHED Published: 2019-08-02T21:27:05 Last Updated: 2024-08-04T21:02:19.171Z Vendors: n/a Products: Magento 2 Problem Types: File Upload Restriction Bypass Description: A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of malicious files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE ID: CVE-2019-7913 State: PUBLISHED Published: 2019-08-02T21:27:25 Last Updated: 2024-08-04T21:02:19.242Z Vendors: n/a Products: Magento 2 Problem Types: Remote Code Execution Description: A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7915 State: PUBLISHED Published: 2019-08-02T21:27:59 Last Updated: 2024-08-04T21:02:19.161Z Vendors: n/a Products: Magento 2 Problem Types: Denial-of-Service Description: A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7921 State: PUBLISHED Published: 2019-08-02T21:28:17 Last Updated: 2024-08-04T21:02:19.124Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7923 State: PUBLISHED Published: 2019-08-02T21:28:36 Last Updated: 2024-08-04T21:02:19.402Z Vendors: n/a Products: Magento 2 Problem Types: Server-side Request Forgery Description: A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7925 State: PUBLISHED Published: 2019-08-02T21:29:03 Last Updated: 2024-08-04T21:02:19.418Z Vendors: n/a Products: Magento 2 Problem Types: Insecure Direct Object Reference Description: An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7926 State: PUBLISHED Published: 2019-08-02T21:29:28 Last Updated: 2024-08-04T21:02:19.360Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE ID: CVE-2019-7927 State: PUBLISHED Published: 2019-08-02T21:29:45 Last Updated: 2024-08-04T21:02:19.411Z Vendors: n/a Products: Magento 2 Problem Types: Cross-Site Scripting Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7928 State: PUBLISHED Published: 2019-08-02T21:30:04 Last Updated: 2024-08-04T21:02:19.423Z Vendors: n/a Products: Magento 2 Problem Types: Denial-of-Service Description: A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol, an unauthenticated attacker could disrupt transactions between the Magento merchant and PayPal. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE ID: CVE-2019-7929 State: PUBLISHED Published: 2019-08-02T21:30:27 Last Updated: 2024-08-04T21:02:19.436Z Vendors: n/a Products: Magento 2 Problem Types: Information Leakage Description: An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE ID: CVE-2019-7930 State: PUBLISHED Published: 2019-08-02T21:30:46 Last Updated: 2024-08-04T21:02:19.378Z Vendors: n/a Products: Magento 2 Problem Types: File Upload Restriction Bypass Description: A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal of file upload restrictions. This can result in arbitrary code execution when a malicious file is then uploaded and executed on the system. Additional Analyst Notes: - CVE Program Container: References: