Vulnerabilities > Magento > Magento > 1.14.1.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-08-02 | CVE-2019-7875 | Cross-site Scripting vulnerability in Magento A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. | 3.5 |
| 2019-08-02 | CVE-2019-7849 | Session Fixation vulnerability in Magento A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. | 5.0 |
| 2019-04-10 | CVE-2019-7139 | SQL Injection vulnerability in Magento An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. | 7.5 |
| 2018-01-08 | CVE-2018-5301 | Cross-Site Request Forgery (CSRF) vulnerability in Magento Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433. | 5.8 |
| 2017-12-30 | CVE-2016-10704 | Cross-site Scripting vulnerability in Magento Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503. | 4.3 |
| 2017-09-26 | CVE-2015-8707 | Information Exposure vulnerability in Magento Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field. | 5.0 |
| 2017-01-23 | CVE-2016-4010 | Injection vulnerability in Magento Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data. | 7.5 |
| 2016-04-15 | CVE-2016-2212 | Information Exposure vulnerability in Magento The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status. | 5.0 |
| 2015-04-29 | CVE-2015-3458 | Permissions, Privileges, and Access Controls vulnerability in Magento 1.14.1.0/1.9.1.0 The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. | 6.5 |
| 2015-04-29 | CVE-2015-3457 | Improper Authentication vulnerability in Magento 1.14.1.0/1.9.1.0 Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter. | 5.0 |