openmage/magento-lts Security Advisories for v20.0.4 (13)
-
[MEDIUM] Magento LTS vulnerable to stored XSS in admin file form
PKSA-7kjg-jm3v-dfw2 GHSA-gp6m-fq6h-cjcx
Affected version: <19.5.3|>=20.0.0,<20.5.0
Reported by:
GitHub -
[HIGH] Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
PKSA-gyfx-x49w-8nbg GHSA-9j5w-2cqc-cwj9
Affected version: <20.2.0
Reported by:
GitHub -
[HIGH] Magento LTS's guest order "protect code" can be brute-forced too easily
PKSA-w6px-tkth-7g4y CVE-2023-41879 GHSA-9358-cpvx-c2qp
Affected version: >=20.0.0,<=20.1.0|<=19.5.0
Reported by:
GitHub -
[HIGH] DataFlow upload remote code execution vulnerability
PKSA-14st-8g6h-6qyt CVE-2021-41231 GHSA-h632-p764-pjqm
Affected version: >=20.0.0,<20.0.19|<19.4.22
Reported by:
GitHub -
[HIGH] Fix for authenticated remote code execution through layout update
PKSA-17zx-zwgr-c4fs CVE-2021-41144 GHSA-5j2g-3ph4-rgvm
Affected version: >=20.0.0,<20.0.19|<19.4.22
Reported by:
GitHub -
[MEDIUM] DoS vulnerability in MaliciousCode filter
PKSA-d7zw-pyw4-4byv CVE-2023-23617 GHSA-3p73-mm7v-4f6m
Affected version: >=20.0.0,<20.0.19|<19.4.22
Reported by:
GitHub -
[HIGH] Fix for arbitrary file deletion in customer media allows for remote code execution
PKSA-69r2-jwnk-px22 CVE-2021-41143 GHSA-5vpv-xmcj-9q85
Affected version: >=20.0.0,<20.0.19|<19.4.22
Reported by:
GitHub -
[HIGH] Fix for arbitrary command execution in custom layout update through blocks
PKSA-mt33-5d4f-b3f9 CVE-2021-39217 GHSA-c9q3-r4rv-mjm7
Affected version: >=20.0.0,<20.0.19|<19.4.22
Reported by:
GitHub -
[MEDIUM] magento-lts Reset Password not protected against well-timed CSRF
PKSA-dgzr-rbc9-1c35 CVE-2021-21395 GHSA-r3c9-9j5q-pwv4
Affected version: >=20.0.0,<20.0.19|<19.4.22
Reported by:
GitHub -
[HIGH] Layout XML Arbitrary Code Fix
PKSA-6tp2-18nz-68zw CVE-2021-32758 GHSA-26rr-v2j2-25fh
Affected version: >=20.0.0,<20.0.13|<19.4.15
Reported by:
GitHub -
[HIGH] Data Flow Sanitation Issue Fix
PKSA-2gfb-xsvf-8zbw CVE-2021-32759 GHSA-xm9f-vxmx-4m58
Affected version: >=20.0.0,<20.0.13|<19.4.15
Reported by:
GitHub -
[CRITICAL] Backport for CVE-2021-21024 Blind SQLi from Magento 2
PKSA-xyp3-9qyk-2bz5 CVE-2021-21427 GHSA-fvrf-9428-527m
Affected version: >=20.0.0,<=20.0.8|<=19.4.12
Reported by:
GitHub -
[CRITICAL] Fixes a bug in Zend Framework's Stream HTTP Wrapper
PKSA-spdm-wpcb-rct9 CVE-2021-21426 GHSA-m496-x567-f98c
Affected version: >=20.0.0,<=20.0.8|<=19.4.12
Reported by:
GitHub