deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7887
Published: 2019-08-02
Description: A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7888
Published: 2019-08-02
Description: An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.
CVSS Score: 6.5 (MEDIUM)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7889
Published: 2019-08-02
Description: An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7890
Published: 2019-08-02
Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.
CVSS Score: 7.3 (HIGH)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7892
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7895
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7896
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7897
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to customer configurations to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7898
Published: 2019-08-02
Description: Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7899
Published: 2019-08-02
Description: Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7903
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7904
Published: 2019-08-02
Description: Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.
CVSS Score: 6.5 (MEDIUM)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7908
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify product information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7909
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7911
Published: 2019-08-02
Description: A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7912
Published: 2019-08-02
Description: A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of malicious files on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7913
Published: 2019-08-02
Description: A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7915
Published: 2019-08-02
Description: A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.
CVSS Score: 7.5 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7921
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7923
Published: 2019-08-02
Description: A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7925
Published: 2019-08-02
Description: An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7926
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7927
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7928
Published: 2019-08-02
Description: A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol, an unauthenticated attacker could disrupt transactions between the Magento merchant and PayPal.
CVSS Score: 7.5 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7929
Published: 2019-08-02
Description: An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.
CVSS Score: 4.9 (MEDIUM)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7930
Published: 2019-08-02
Description: A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal of file upload restrictions. This can result in arbitrary code execution when a malicious file is then uploaded and executed on the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7932
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7934
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7935
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content page titles to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7936
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7937
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7938
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7939
Published: 2019-08-02
Description: A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7940
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify store currency options to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24
CVE: CVE-2019-7942
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7944
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24
CVE: CVE-2019-7945
Published: 2019-08-02
Description: A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7947
Published: 2019-08-02
Description: A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7950
Published: 2019-08-02
Description: An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7951
Published: 2019-08-02
Description: An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.
CVSS Score: 7.5 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-14551
Published: 2019-08-03
Description: Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origin /install request with an attacker-controlled releaseUrl, which triggers download and execution of code within a ZIP archive.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-352
References: https://griffinbyatt.com/2019/08/02/Das-Vulnerabilities.html; https://griffinbyatt.com/2019/08/02/Das-Vulnerabilities.html
CVE: CVE-2019-14653
Published: 2019-08-03
Description: pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pandao/editor.md/issues/715; https://github.com/pandao/editor.md/issues/715