deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18456
Published: 2019-08-02
Description: cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18457
Published: 2019-08-02
Description: cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18458
Published: 2019-08-02
Description: cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18459
Published: 2019-08-02
Description: cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18460
Published: 2019-08-02
Description: cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18461
Published: 2019-08-02
Description: cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18463
Published: 2019-08-02
Description: cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/cpanel-tsr-2017-0002-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2019-10961
Published: 2019-08-02
Description: In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior, processing specially crafted MCR files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area, allowing remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-01; https://www.zerodayinitiative.com/advisories/ZDI-19-691/; https://www.us-cert.gov/ics/advisories/icsa-19-213-01
CVE: CVE-2019-10088
Published: 2019-08-02
Description: A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-770
References: https://lists.apache.org/thread.html/1c63555609b737c20d1bbfa4a3e73ec488e3408a84e2f5e47e1b7e08%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/39723d8227b248781898c200aa24b[PII_REDACTED]7b150a204b83787d%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/da9ee189d1756f8508d0f2386d8e25aca5a6df[PII_REDACTED]32be8a94%40%3Cdev.tika.apache.org%3E
CVE: CVE-2019-10093
Published: 2019-08-02
Description: In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://lists.apache.org/thread.html/39723d8227b248781898c200aa24b[PII_REDACTED]7b150a204b83787d%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/da9ee189d1756f8508d0f2386d8e25aca5a6df[PII_REDACTED]32be8a94%40%3Cdev.tika.apache.org%3E
CVE: CVE-2019-10094
Published: 2019-08-02
Description: A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: https://lists.apache.org/thread.html/39723d8227b248781898c200aa24b[PII_REDACTED]7b150a204b83787d%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/da9ee189d1756f8508d0f2386d8e25aca5a6df[PII_REDACTED]32be8a94%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/fb6c84fd387de997e5e366d50b0ca331a328c466432c80f8c5eed33d%40%3Cdev.tika.apache.org%3E
CVE: CVE-2019-14541
Published: 2019-08-02
Description: GnuCOBOL 2.2 has a stack-based buffer overflow in cb_encode_program_id in cobc/typeck.c via crafted COBOL source code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://sourceforge.net/p/open-cobol/bugs/584/; https://sourceforge.net/p/open-cobol/bugs/584/
CVE: CVE-2019-6968
Published: 2019-08-02
Description: The web interface of the D-Link DVA-5[PII_REDACTED]3 is vulnerable to XSS because HTML form parameters are directly reflected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/; https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/
CVE: CVE-2019-6969
Published: 2019-08-02
Description: The web interface of the D-Link DVA-5[PII_REDACTED]3 is vulnerable to an authentication bypass that allows an unauthenticated user to have access to sensitive information such as the Wi-Fi password and the phone number (if VoIP is in use).
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/; https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/
CVE: CVE-2019-7163
Published: 2019-08-02
Description: The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthenticated user to have access to the web interface without knowing the administrator's password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/; https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/
CVE: CVE-2019-14544
Published: 2019-08-02
Description: routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/gogs/gogs/issues/5764; https://github.com/gogs/gogs/issues/5764
CVE: CVE-2019-7849
Published: 2019-08-02
Description: A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7851
Published: 2019-08-02
Description: A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7852
Published: 2019-08-02
Description: A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7853
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento admin panel.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24
CVE: CVE-2019-7854
Published: 2019-08-02
Description: An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7855
Published: 2019-08-02
Description: A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-338
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7857
Published: 2019-08-02
Description: A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7858
Published: 2019-08-02
Description: A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7859
Published: 2019-08-02
Description: A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24
CVE: CVE-2019-7860
Published: 2019-08-02
Description: A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7861
Published: 2019-08-02
Description: Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7862
Published: 2019-08-02
Description: A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7863
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7864
Published: 2019-08-02
Description: An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7865
Published: 2019-08-02
Description: A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7866
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7867
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7868
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7869
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7871
Published: 2019-08-02
Description: A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7872
Published: 2019-08-02
Description: An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7873
Published: 2019-08-02
Description: A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
CVE: CVE-2019-7874
Published: 2019-08-02
Description: A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7875
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7876
Published: 2019-08-02
Description: A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
CVSS Score: 8.8 (HIGH)
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7877
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7880
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7881
Published: 2019-08-02
Description: A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7882
Published: 2019-08-02
Description: A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
CVE: CVE-2019-7885
Published: 2019-08-02
Description: Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
CVE: CVE-2019-7886
Published: 2019-08-02
Description: A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33; https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33