Vulnerabilities > Magento > Magento > 1.9.2.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-11-06 | CVE-2019-8232 | Race Condition vulnerability in Magento In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification. | 6.0 |
| 2019-11-06 | CVE-2019-8231 | Unspecified vulnerability in Magento In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification. | 6.5 |
| 2019-11-06 | CVE-2019-8230 | Unspecified vulnerability in Magento In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path. | 6.5 |
| 2019-11-06 | CVE-2019-8229 | Unspecified vulnerability in Magento In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates. | 6.5 |
| 2019-11-06 | CVE-2019-8228 | Cross-site Scripting vulnerability in Magento in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template. | 3.5 |
| 2019-11-06 | CVE-2019-8227 | Cross-site Scripting vulnerability in Magento In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML. | 3.5 |
| 2019-11-06 | CVE-2019-8155 | Cross-Site Request Forgery (CSRF) vulnerability in Magento Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. | 5.0 |
| 2019-11-06 | CVE-2019-8152 | Cross-site Scripting vulnerability in Magento A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. | 3.5 |
| 2019-11-05 | CVE-2019-8125 | Unspecified vulnerability in Magento A remote code execution vulnerability exists in Magento 1 prior to 1.9.x and 1.14.x. | 6.5 |
| 2019-11-05 | CVE-2019-8123 | Unspecified vulnerability in Magento An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. | 5.0 |