Unauthenticated crypto and weak IV in Magento\Framework\Encryption

CVE-2016-6485

Affected version: >=2.0,<2.2.6

Reported by:
GitHub

JavaScript injection possible via html comments

CVE-2019-8233

Affected version: >=2.3,<2.3.3|>=2.2,<2.2.10

Reported by:
GitHub

Cross-Site Scripting via Attribute Set Name

CVE-2019-8145

Affected version: >=2.3,<2.3.3|>=2.2,<2.2.10

Reported by:
GitHub

Bypass of sitemp access restrictions

CVE-2019-8133

Affected version: >=2.3,<2.3.3|>=2.2,<2.2.10

Reported by:
GitHub

Remote code execution via vulnerable Symphony dependecy injection

CVE-2019-8135

Affected version: >=2.3,<2.3.3|>=2.2,<2.2.10

Reported by:
GitHub

Using JS libraries with known security vulnerabilities

CVE-2019-8121

Affected version: >=2.3,<2.3.3|>=2.2,<2.2.10

Reported by:
GitHub

Information disclosure through processing of external XML entities

CVE-2019-8126

Affected version: >=2.3,<2.3.3|>=2.2,<2.2.10

Reported by:
GitHub