Magento
Page 3 of 3 — Magento CVEs from a corpus of 224, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-7861 | High | 7.5 | 2019-08-02 | Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior… |
CVE-2019-7860 | High | 7.5 | 2019-08-02 | A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2… |
CVE-2019-7859 | High | 7.5 | 2019-08-02 | A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in un… |
CVE-2019-7858 | High | 7.5 | 2019-08-02 | A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information wit… |
CVE-2019-7857 | Medium | 4.3 | 2019-08-02 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to b… |
CVE-2019-7855 | Medium | 5.3 | 2019-08-02 | A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discov… |
CVE-2019-7854 | High | 7.5 | 2019-08-02 | An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to una… |
CVE-2019-7853 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploi… |
CVE-2019-7852 | Medium | 5.3 | 2019-08-02 | A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file pat… |
CVE-2019-7851 | Medium | 6.5 | 2019-08-02 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data d… |
CVE-2019-7849 | High | 7.5 | 2019-08-02 | A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2… |
CVE-2019-7139 | Critical | 9.8 | 2019-04-10 | An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue… |
CVE-2018-5301 | Medium | 6.5 | 2018-01-08 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address boo… |
CVE-2016-10704 | Medium | 6.1 | 2017-12-30 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka A… |
CVE-2015-8707 | Critical | 9.8 | 2017-09-26 | Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote… |
CVE-2014-9758 | Medium | 6.1 | 2017-09-20 | Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1. |
CVE-2016-6485 | High | 7.5 | 2017-03-01 | The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, w… |
CVE-2016-4010 | Critical | 9.8 | 2017-01-23 | Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shoppin… |
CVE-2016-2212 | Medium | 5.3 | 2016-04-15 | The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3… |
CVE-2015-3458 | | 2015-04-29 | The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restr… | |
CVE-2015-3457 | | 2015-04-29 | Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter. | |
CVE-2015-1399 | | 2015-04-29 | PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Ente… | |
CVE-2015-1398 | | 2015-04-29 | Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to… | |
CVE-2015-1397 | | 2015-04-29 | SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise E… |