Cookie Consent by Free Privacy Policy Generator 📌 [PRODSECBUG-2337/PRODSECBUG-2307] Stored cross-site scripting in the catalog templates form - CVE-2019-7921 / Insufficient enforcement of user access controls could lead to unauthorized environment configuration changes - CVE-2019-7904
Team IT Security Nachrichtenportal Logo

🏠 Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeiträge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden Überblick über die wichtigsten Aspekte der IT-Sicherheit in einer sich ständig verändernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch übersetzen, erst Englisch auswählen dann wieder Deutsch!

Google Android Playstore Download Button für Team IT Security
RSS Feed Symbol für Team IT Security 800+ IT News als RSS Feed abonnieren



📚 [PRODSECBUG-2337/PRODSECBUG-2307] Stored cross-site scripting in the catalog templates form - CVE-2019-7921 / Insufficient enforcement of user access controls could lead to unauthorized environment configuration changes - CVE-2019-7904


💡 Newskategorie: Sicherheitslücken
🔗 Quelle: portal.patchman.co

PRODSECBUG-2337: A stored cross-site scripting vulnerability existed in the product catalog form. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript.

PRODSECBUG-2307: Insufficient enforcement of user access controls could be abused by a low-privileged user to make unauthorized environment configuration changes, such as removing security controls.

Part of update Magento 2.3.2, 2.2.9 and 2.1.18 Security Update 2/3

This vulnerability affects the following application versions:

  • Magento 2.0.0
  • Magento 2.0.1
  • Magento 2.0.2
  • Magento 2.0.3
  • Magento 2.0.4
  • Magento 2.0.5
  • Magento 2.0.6
  • Magento 2.0.7
  • Magento 2.0.8
  • Magento 2.0.9
  • Magento 2.0.10
  • Magento 2.0.11
  • Magento 2.0.12
  • Magento 2.0.13
  • Magento 2.0.14
  • Magento 2.0.15
  • Magento 2.0.16
  • Magento 2.0.17
  • Magento 2.0.18
  • Magento 2.1.0
  • Magento 2.1.1
  • Magento 2.1.2
  • Magento 2.1.3
  • Magento 2.1.4
  • Magento 2.1.5
  • Magento 2.1.6
  • Magento 2.1.7
  • Magento 2.1.8
  • Magento 2.1.9
  • Magento 2.1.10
  • Magento 2.1.11
  • Magento 2.1.12
  • Magento 2.1.13
  • Magento 2.1.14
  • Magento 2.1.15
  • Magento 2.1.16
  • Magento 2.1.17
  • Magento 2.2.0
  • Magento 2.2.1
  • Magento 2.2.2
  • Magento 2.2.3
  • Magento 2.2.4
  • Magento 2.2.5
  • Magento 2.2.6
  • Magento 2.2.7
  • Magento 2.2.8
  • Magento 2.2.11
  • Magento 2.3.0
  • Magento 2.3.1
...



Sharing is caring on Social Media

🔗 Reddit
🔗 Telegram
🔗 LinkedIn
🔗 Xing
🔗 Twitter
🔗 Whatsapp
🔗 Facebook
🔗 Flipboard

Join the Team IT Security Community

🔗 "IT Sicherheit" Reddit-Gruppe
🔗 "IT Sicherheit" Telegramm-Seite

📌 Bugtraq: [security bulletin] HPSBUX03574 rev.1 - HPE HP-UX CIFS-Server (Samba), Remote Access Restriction Bypass, Authentication bypass, Denial of Service (DoS), Unauthorized Access to Files, Access Restriction Bypass, Unauthorized Information Disclo


📈 43 Punkte

📌 Bugtraq: [security bulletin] HPSBUX03574 rev.1 - HPE HP-UX CIFS-Server (Samba), Remote Access Restriction Bypass, Authentication bypass, Denial of Service (DoS), Unauthorized Access to Files, Access Restriction Bypass, Unauthorized Information Disclo


📈 43 Punkte

📌 WordPress Royal Elementor 1.3.59 XSS / CSRF / Insufficient Access Controls


📈 31.94 Punkte

📌 Catching Configuration Changes that Can Lead to Data Exposure


📈 29.97 Punkte

📌 Two flaws that could lead to Potential lead to RCE fixed by OpenSSL project team


📈 28.85 Punkte

📌 Cgiscript.net csMailto csMailto.cgi form-to/form-from/form-results privilege escalation


📈 28.52 Punkte

📌 Bugtraq: [security bulletin] HPESBHF03741 rev.1 - HPE Network products including Comware 7, IMC, and VCX running OpenSSL, Local Unauthorized Disclosure of Information, Remote Denial of Service (DoS), Unauthorized Disclosure of Information


📈 28.51 Punkte

📌 Bugtraq: [security bulletin] HPESBMU03806 rev.1 - HPE IceWall Products, Multiple Remote Unauthorized Disclosure of Information, Unauthorized Modificiation


📈 28.51 Punkte

📌 ZTE ZXDSL 831 Unauthorized Configuration Access Bypass


📈 28.03 Punkte

📌 ZTE ZXDSL 831 Unauthorized Configuration Access Bypass


📈 28.03 Punkte

📌 LinkedIn: Unauthorized access to resumes stored on LinkedIn


📈 27.89 Punkte

📌 Demystifying ARM Templates: Intro to ARM Templates | The DevOps Lab


📈 27.59 Punkte

📌 Configuration as Code Plugin up to 1.24 on Jenkins Configuration Import Environment Variable information disclosure


📈 27.55 Punkte

📌 Added escaping to admin templates for the catalog module to avoid XSS


📈 27.44 Punkte

📌 Added escaping to elements in the frontend templates for the catalog module to avoid XSS


📈 27.44 Punkte

📌 Xpdf 4.02 Catalog.cc Catalog.pageLabels NULL Pointer Dereference denial of service


📈 27.29 Punkte

📌 [PRODSECBUG-2162] Unauthorized data control due to a bypass of authentication controls for a customer using a web API endpoint


📈 26 Punkte

📌 NordVPN: Unauthorized User Can Delete Any User Account


📈 25.86 Punkte

📌 Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access


📈 25.47 Punkte

📌 Design Flaw in Google Workspace Could Let Attackers Gain Unauthorized Access


📈 25.47 Punkte

📌 XZ Struck By Malicious Code That Could Allow Unauthorized Remote System Access


📈 25.47 Punkte

📌 Frost Bank Detects Unauthorized Access that Could Have Exposed Check Images


📈 25.47 Punkte

📌 Stops Core Theme And Plugin Updates < 8.0.5 - Insufficient Restrictions on Option Changes


📈 25.16 Punkte

📌 [APPSEC-1825] PHP Object Injection in E-mail templates lead to Remote Code Execution


📈 25.02 Punkte

📌 Twitter Bug That Enables Third-party apps to get Unauthorized Access to User’s Direct Messages


📈 24.89 Punkte

📌 Dropcontact: IDOR at [https://dropcontact.firstpromote] which allows an UNAUTHORIZED user to ACCESS and EDIT Paypal GMAIL by Changing the ID.


📈 24.89 Punkte

📌 Unauthorized user access in backend module


📈 24.89 Punkte

📌 Suppose you are in a corporate network environment and often times find yourself manually setting/unsetting the HTTP_PROXY environment variable in order to access different hosts. Sounds familiar? In this case, dePAC might help you!


📈 24.14 Punkte

📌 Upcoming iOS Access Restrictions Could Stymie Law Enforcement


📈 24.11 Punkte

📌 Eggheads show how network flaw could lead to NASA crew pod loss. Key word: Could


📈 24.01 Punkte

📌 Bugtraq: [security bulletin] HPSBUX03596 rev.1 - HPE HP-UX running CIFS Server (Samba), Remote Access Restriction Bypass, Unauthorized Access


📈 23.91 Punkte

📌 Bugtraq: [security bulletin] HPSBGN03638 rev.1 - HPE Remote Device Access: Virtual Customer Access System (vCAS) using lighttpd and OpenSSH, Unauthorized Modification of Information, Remote Denial of Service (DoS), Remote Disclosure of Information


📈 23.91 Punkte

📌 Bugtraq: [security bulletin] HPSBGN03645 rev.2 - HPE Helion OpenStack Glance, Remote Access Restriction Bypass, Unauthorized Access


📈 23.91 Punkte

📌 Bugtraq: [security bulletin] HPSBUX03596 rev.1 - HPE HP-UX running CIFS Server (Samba), Remote Access Restriction Bypass, Unauthorized Access


📈 23.91 Punkte

📌 Bugtraq: [security bulletin] HPSBGN03638 rev.1 - HPE Remote Device Access: Virtual Customer Access System (vCAS) using lighttpd and OpenSSH, Unauthorized Modification of Information, Remote Denial of Service (DoS), Remote Disclosure of Information


📈 23.91 Punkte











matomo

Kontakt

24/7 [email protected]

Weitere Informationen

Google Android Playstore Download Button für Team IT Security
🔗 Impressum
🔗 Datenschutz
Paypal Spenden für Projekt

Social Media

🔗 Facebook
🔗 Reddit
🔗 Team IT Security als Elektron App
🔗 © 2015-2023 Team IT Security Nachrichtenportal über Cybersecurity
🔗 CMS "myDraft" a PHP Portal Software