PackagistPackage

magento/community-edition

353 known vulnerabilities (30 critical, 55 high, 99 medium, 15 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 353 · 30 critical, 55 high, 99 medium, 15 low

Registry: Packagist

Advisories 353

CVE-2025-54267Medium 6.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha3; from 2.4.8-beta1, fixed in 2.4.8-p3; from 2.4.7-beta1, fixed in 2.4.7-p8; fixed in 2.4.6-p13; versions 2.4.8; versions 2.4.7; versions 2.4.6.
CVE-2025-54266Medium 4.8
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha3; from 2.4.8-beta1, fixed in 2.4.8-p3; from 2.4.7-beta1, fixed in 2.4.7-p8; fixed in 2.4.6-p13; versions 2.4.8; versions 2.4.7; versions 2.4.6.
CVE-2025-54263High 8.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha3; from 2.4.8-beta1, fixed in 2.4.8-p3; from 2.4.7-beta1, fixed in 2.4.7-p8; fixed in 2.4.6-p13; versions 2.4.8; versions 2.4.7; versions 2.4.6.
CVE-2025-54265Medium 5.9
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha3; from 2.4.8-beta1, fixed in 2.4.8-p3; from 2.4.7-beta1, fixed in 2.4.7-p8; fixed in 2.4.6-p13; versions 2.4.8; versions 2.4.7; versions 2.4.6.
CVE-2025-54264High 8.1
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha3; from 2.4.8-beta1, fixed in 2.4.8-p3; from 2.4.7-beta1, fixed in 2.4.7-p8; fixed in 2.4.6-p13; versions 2.4.8; versions 2.4.7; versions 2.4.6.
CVE-2025-54236Critical 9.1 · KEV
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.4.5-p14; versions 2.4.6; from 2.4.6-p1, through 2.4.6-p12; versions 2.4.5; from 2.4.9-alpha1, through 2.4.9-alpha2; versions 2.4.7; versions 2.4.8; from 2.4.7-beta1, through 2.4.7-p7; from 2.4.8-beta1, through 2.4.8-p2; versions 2.4.9.
CVE-2025-49556High 7.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha2; from 2.4.8-beta1, fixed in 2.4.8-p2; from 2.4.7-beta1, fixed in 2.4.7-p7; from 2.4.6-p1, fixed in 2.4.6-p12; fixed in 2.4.5-p14; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-49557High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: fixed in 2.4.4-p15; from 2.4.5-p1, fixed in 2.4.5-p14; from 2.4.6-p1, fixed in 2.4.6-p12; from 2.4.7-p1, fixed in 2.4.7-p7; versions 2.4.8.
CVE-2025-49558Medium 5.9
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha2; from 2.4.8-beta1, fixed in 2.4.8-p2; from 2.4.7-beta1, fixed in 2.4.7-p7; from 2.4.6-p1, fixed in 2.4.6-p12; fixed in 2.4.5-p14; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-49554High 7.5
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha2; from 2.4.8-beta1, fixed in 2.4.8-p2; from 2.4.7-beta1, fixed in 2.4.7-p7; from 2.4.6-p1, fixed in 2.4.6-p12; fixed in 2.4.5-p14; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-49559Medium 5.3
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha2; from 2.4.8-beta1, fixed in 2.4.8-p2; from 2.4.7-beta1, fixed in 2.4.7-p7; from 2.4.6-p1, fixed in 2.4.6-p12; fixed in 2.4.5-p14; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-49555High 8.1
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: from 2.4.9-alpha1, fixed in 2.4.9-alpha2; from 2.4.8-beta1, fixed in 2.4.8-p2; from 2.4.7-beta1, fixed in 2.4.7-p7; from 2.4.6-p1, fixed in 2.4.6-p12; fixed in 2.4.5-p14; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-49550Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p6; from 2.4.6-p1, fixed in 2.4.6-p11; fixed in 2.4.5-p13; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-49549Low 2.7
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p6; from 2.4.6-p1, fixed in 2.4.6-p11; fixed in 2.4.5-p13; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-27206Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p6; from 2.4.6-p1, fixed in 2.4.6-p11; fixed in 2.4.5-p13; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.

Show all 353 advisoriesShow fewer advisories

CVE-2025-47110High 8.4
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.8-beta1, fixed in 2.4.8-p1; from 2.4.7-beta1, fixed in 2.4.7-p6; fixed in 2.4.5-p13; versions 2.4.7; versions 2.4.8; versions 2.4.5; from 2.4.6-p1, fixed in 2.4.6-p11; versions 2.4.6.
CVE-2025-43585High 8.2
Adobe Commerce | Improper Authorization (CWE-285)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p6; from 2.4.6-p1, fixed in 2.4.6-p11; fixed in 2.4.5-p13; versions 2.4.5; versions 2.4.6; versions 2.4.7; versions 2.4.8.
CVE-2025-27190Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p5; from 2.4.6-p1, fixed in 2.4.6-p10; from 2.4.5-p1, fixed in 2.4.5-p12; fixed in 2.4.4-p13; from 2.4.8-beta1, fixed in 2.4.8-beta2; versions 2.4.5; versions 2.4.4; versions 2.4.6; versions 2.4.7.
CVE-2025-27191Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p5; from 2.4.6-p1, fixed in 2.4.6-p10; from 2.4.5-p1, fixed in 2.4.5-p12; fixed in 2.4.4-p13; from 2.4.8-beta1, fixed in 2.4.8-beta2; versions 2.4.5; versions 2.4.4; versions 2.4.6; versions 2.4.7.
CVE-2025-27192Low 2.7
Adobe Commerce | Insufficiently Protected Credentials (CWE-522)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p5; from 2.4.6-p1, fixed in 2.4.6-p10; from 2.4.5-p1, fixed in 2.4.5-p12; fixed in 2.4.4-p13; from 2.4.8-beta1, fixed in 2.4.8-beta2; versions 2.4.5; versions 2.4.4; versions 2.4.6; versions 2.4.7.
CVE-2025-27188Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: fixed in 2.4.4-p13; versions 2.4.4; versions 2.4.5; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p12; from 2.4.6-p1, fixed in 2.4.6-p10; from 2.4.7-p1, fixed in 2.4.7-p5; versions 2.4.7; from 2.4.8-beta1, fixed in 2.4.8.
CVE-2025-24414High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24437Medium 5.4
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24434Critical 9.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.8-beta1, fixed in 2.4.8-beta2; from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12.
CVE-2025-24415High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24411High 8.1
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24416High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24413High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24432Low 3.7
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24424Medium 6.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24430Low 3.7
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24429Low 3.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24436Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24438High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24406High 7.5
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24417High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24409High 8.2
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24425Medium 5.3
Adobe Commerce | Business Logic Errors (CWE-840)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24421Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.8-beta1.
CVE-2025-24412High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24427Medium 6.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24428Medium 5.4
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24410High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24408Medium 6.5
Adobe Commerce | Information Exposure (CWE-200)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; from 2.4.5-p1, fixed in 2.4.5-p11; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2025-24435Medium 4.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p4; from 2.4.6-p1, fixed in 2.4.6-p9; fixed in 2.4.4-p12; versions 2.4.7; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p11; versions 2.4.5; versions 2.4.4; versions 2.4.8-beta1.
CVE-2024-45127Medium 4.8
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45128Medium 5.4
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45133Low 2.7
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45124Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45123Medium 6.1
Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45121Medium 4.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45117High 7.6
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45116High 8.1
Adobe Commerce | Cross-site Scripting (XSS) (CWE-79)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45119Medium 4.9
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45122Medium 4.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45135Low 2.7
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45120Low 3.1
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45130Medium 4.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45132Medium 6.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45131Medium 5.4
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45134Low 2.7
Adobe Commerce | Information Exposure (CWE-200)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45129Medium 4.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45118Medium 6.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45149Low 2.7
Adobe Commerce | Improper Access Control (CWE-284)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-45125Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p3; from 2.4.6-p1, fixed in 2.4.6-p8; from 2.4.5-p1, fixed in 2.4.5-p10; fixed in 2.4.4-p11; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39419Medium 4.3
A user without ship permissions can ship the orders
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; fixed in 2.4.4-p10; versions 2.4.4; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-39403High 7.6
Stored XSS through Webhook module public key configuration
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39418Medium 5.4
Adobe Commerce | Improper Authorization (CWE-285)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39413Medium 4.3
An unauthorized user can export the Invoiced Sales Report
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39399High 7.7
[Paris] Path Traversal lead to local file read
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39408Medium 4.3
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: from 2.4.7-p1, fixed in 2.4.7-p2; versions 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p7; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p9; versions 2.4.5; fixed in 2.4.4-p10; versions 2.4.4.
CVE-2024-39417Medium 4.3
An unauthorized user can export the Shipping Report
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; fixed in 2.4.4-p10; versions 2.4.4; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-39410Medium 4.3
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: from 2.4.7-p1, fixed in 2.4.7-p2; versions 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p7; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p9; versions 2.4.5; fixed in 2.4.4-p10; versions 2.4.4.
CVE-2024-39407Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39398High 7.4
OTP 2FA can be bruteforced
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39401High 8.4
Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39409Medium 4.3
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: from 2.4.7-p1, fixed in 2.4.7-p2; versions 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p7; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p9; versions 2.4.5; fixed in 2.4.4-p10; versions 2.4.4.
CVE-2024-39411Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; fixed in 2.4.4-p10; versions 2.4.4; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-39416Medium 4.3
Unauthorized user can export Orders Sale Report
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; fixed in 2.4.4-p10; versions 2.4.4; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-39414Medium 4.3
Being able to import/export tax rates without proper privileges
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; fixed in 2.4.4-p10; versions 2.4.4; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-39412Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: from 2.4.7-p1, fixed in 2.4.7-p2; versions 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p7; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p9; versions 2.4.5; fixed in 2.4.4-p10; versions 2.4.4.
CVE-2024-39402High 8.4
Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39406Medium 6.8
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: from 2.4.7-p1, fixed in 2.4.7-p2; versions 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p7; versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p9; versions 2.4.5; fixed in 2.4.4-p10; versions 2.4.4.
CVE-2024-39400High 8.1
DOM XSS through integrations can impact other admins
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39404Medium 4.3
A user without Shop Policy Parameters section privilege can alter the shop policy parameters section
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-39415Medium 4.3
An unauthorized user can export the Tax Sales Report
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; fixed in 2.4.4-p10; versions 2.4.4; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-39405Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: from 2.4.7-beta1, fixed in 2.4.7-p2; from 2.4.6-p1, fixed in 2.4.6-p7; from 2.4.5-p1, fixed in 2.4.5-p9; from 2.4.4-p1, fixed in 2.4.4-p10; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4.
CVE-2024-34106Medium 5.3
Insecure Direct Object Reference - An attacker can able to erase the victim quote details
Affected: versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9.
CVE-2024-34103High 8.1
Customer account takeover via web API call & subsequent password reset
Affected: versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9.
CVE-2024-34111Medium 6.5
SSRF in service connector
Affected: versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9.
CVE-2024-34107Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9.
CVE-2024-34105Medium 4.8
Stored Cross Site Scripting in Order Comment
Affected: versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9.
CVE-2024-34104High 8.2
Adobe Commerce | Improper Authorization (CWE-285)
Affected: versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9.
CVE-2024-34102Critical 9.8 · KEV
XXE can expose crypt key and other secrets granting full admin access
Affected: versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p6; from 2.4.5-p1, fixed in 2.4.5-p8; fixed in 2.4.4-p9; versions 2.4.5; versions 2.4.6; versions 2.4.7.
CVE-2024-20758Critical 9.0
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.7-beta1, fixed in 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p5; from 2.4.5-p1, fixed in 2.4.5-p7; from 2.4.4-p1, fixed in 2.4.4-p8.
CVE-2024-20759High 8.1
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.7-beta1, fixed in 2.4.7; from 2.4.6-p1, fixed in 2.4.6-p5; from 2.4.5-p1, fixed in 2.4.5-p7; from 2.4.4-p1, fixed in 2.4.4-p8.
CVE-2024-20716Medium 4.9
Force high-usage of resources by generating unlimited coupons: Adobe Commerce
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p4; from 2.4.5-p1, fixed in 2.4.5-p6; from 2.4.4-p1, fixed in 2.4.4-p7.
CVE-2024-20718Medium 4.3
[Spain] CSRF to delete Requisition Lists at Adobe Commerce
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p4; from 2.4.5-p1, fixed in 2.4.5-p6; from 2.4.4-p1, fixed in 2.4.4-p7.
CVE-2024-20719Critical 9.1
[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p4; from 2.4.5-p1, fixed in 2.4.5-p6; from 2.4.4-p1, fixed in 2.4.4-p7.
CVE-2024-20720Critical 9.1
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p4; from 2.4.5-p1, fixed in 2.4.5-p6; from 2.4.4-p1, fixed in 2.4.4-p7.
CVE-2023-38251Medium 5.3
Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-38219High 8.7
Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-38220High 7.5
Full page cache enumeration via cookie X-Magento-Vary
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-26367Medium 4.9
Error based file extraction via PHP filter chains during product bulk import logic
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-26366Medium 6.8
Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-38218High 8.8
Incorrect Authorization - Customer account takeover
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-38250High 8.0
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-38249High 8.0
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.7; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2023-38221High 8.0
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected: from 2.4.7-beta1, fixed in 2.4.7-beta2; versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p3; from 2.4.5-p1, fixed in 2.4.5-p5; from 2.4.4-p1, fixed in 2.4.4-p6.
CVE-2022-24093Critical 9.1
Adobe Commerce post-auth improper input validation leads to remote code execution
Affected: versions 2.4.3; versions 2.3.7; from 2.4.3-p1, fixed in 2.4.3-p2; from 2.3.7-p1, fixed in 2.3.7-p3.
CVE-2021-36036High 7.2
Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36021High 7.2
Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36023Critical 9.1
Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2023-38207High 7.5
Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p2; from 2.4.5-p1, fixed in 2.4.5-p4; from 2.4.4-p1, fixed in 2.4.4-p5.
CVE-2023-38208Critical 9.1
Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p2; from 2.4.5-p1, fixed in 2.4.5-p4; from 2.4.4-p1, fixed in 2.4.4-p5.
CVE-2023-38209Medium 6.5
Adobe Commerce Incorrect Authorization Security feature bypass
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.6-p1, fixed in 2.4.6-p2; from 2.4.5-p1, fixed in 2.4.5-p4; from 2.4.4-p1, fixed in 2.4.4-p5.
CVE-2023-29297Critical 9.1
Admin-to-admin stored XSS via cache poisoning
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29296Medium 4.3
[Cloud] Customer suspects IDOR vulnerability
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29295Medium 4.3
Insecure Direct Object Reference (IDOR) in Create Quote Function
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29294Medium 4.3
Bypass Purchase Order Approval using Company User in Adobe Commerce B2B
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29293Low 2.7
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29292Medium 4.9
Server Side Request Forgery (SSRF) in FedEx carrier integration configuration
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29291Medium 4.9
Server Side Request Forgery (SSRF) in USPS carrier integration configuration
Affected: versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4; versions 2.4.5; versions 2.4.4.
CVE-2023-29290Medium 5.3
Adobe Commerce Guest Cart Shipping Address Overwrite IDOR
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29289Medium 6.5
Adobe Commerce XML Injection Security feature bypass
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-29288Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4; versions 2.4.4; versions 2.4.5.
CVE-2023-29287Medium 5.3
Adobe Commerce Information Exposure Security feature bypass
Affected: versions 2.4.6; versions 2.4.5; versions 2.4.4; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.4-p4.
CVE-2023-22248High 7.5
Adobe Commerce Incorrect Authorization Security feature bypass
Affected: versions 2.4.6; from 2.4.5-p1, fixed in 2.4.5-p3; from 2.4.4-p1, fixed in 2.4.5-p4; versions 2.4.4; versions 2.4.5.
CVE-2023-22251Medium 4.3
Adobe Commerce Incorrect Authorization Security feature bypass
Affected: from 2.4.4-p1, fixed in 2.4.4-p3; from 2.4.5-p1, fixed in 2.4.5-p2; versions 2.4.5; versions 2.4.4.
CVE-2023-22250Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: from 2.4.4-p1, fixed in 2.4.4-p3; versions 2.4.4; versions 2.4.5; from 2.4.5-p1, fixed in 2.4.5-p2.
CVE-2023-22249Medium 4.8
Adobe Commerce Stored XSS Arbitrary code execution
Affected: versions 2.4.4; versions 2.4.5; from 2.4.4-p1, through 2.4.4-p2; versions 2.4.5-p1.
CVE-2023-22247High 7.5
Adobe Commerce XML Injection Arbitrary file system read
Affected: from 2.4.5-p1, fixed in 2.4.5-p2; versions 2.4.5; from 2.4.4-p1, fixed in 2.4.4-p3; versions 2.4.4.
CVE-2022-42344High 8.8
[CVE-2021-36032] Magento IDOR Leads to Account Takeover
Affected: fixed in 2.3.7-p4; from 2.4.0, fixed in 2.4.3-p3; from 2.4.4, fixed in 2.4.5.
CVE-2022-35689Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: from 2.4.4-p1, fixed in 2.4.4-p2; versions 2.4.4; versions 2.4.5; from 2.4.3-p1, through 2.4.3-p3; versions 2.4.3.
CVE-2022-35698Critical 10.0
Adobe Commerce Stored XSS Arbitrary code execution
Affected: versions 2.4.4-p1; versions 2.4.4; versions 2.4.5; from 2.4.3-p1, through 2.4.3-p3; versions 2.4.3.
CVE-2022-35692Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: from 2.4.3-p1, fixed in 2.4.3-p3; from 2.3.7-p1, fixed in 2.3.7-p4; versions 2.3.7; versions 2.4.4; versions 2.4.3.
CVE-2022-34259Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: from 2.3.0, fixed in 2.3.7-p4; from 2.4.4, fixed in 2.4.5; from 2.4.0, fixed in 2.4.3-p3.
CVE-2022-34257Medium 6.1
Adobe Commerce Stored XSS Arbitrary code execution
Affected: from 2.3.0, fixed in 2.3.7-p4; from 2.4.4, fixed in 2.4.5; from 2.4.0, fixed in 2.4.3-p3.
CVE-2022-34253Critical 9.1
Adobe Commerce XML Injection Arbitrary code execution
Affected: fixed in 2.3.7-p4; from 2.4.4, fixed in 2.4.5; from 2.4.0, fixed in 2.4.3-p3.
CVE-2022-34255High 8.8
Adobe Commerce Improper Access Control Privilege escalation
Affected: from 2.3.0, fixed in 2.3.7-p4; from 2.4.4, fixed in 2.4.5; from 2.4.0, fixed in 2.4.3-p3.
CVE-2022-34254High 8.5
Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution
Affected: from 2.3.0, fixed in 2.3.7-p4; from 2.4.0, fixed in 2.4.3-p3; from 2.4.4, fixed in 2.4.5.
CVE-2022-34256High 7.5
Adobe Commerce Improper Authorization Privilege escalation
Affected: from 2.3.0, fixed in 2.3.7-p4; from 2.4.4, fixed in 2.4.5; from 2.4.0, fixed in 2.4.3-p3.
CVE-2022-34258Medium 4.8
Adobe Commerce Stored XSS Arbitrary code execution
Affected: from 2.3.0, fixed in 2.3.7-p4; from 2.4.4, fixed in 2.4.5; from 2.4.0, fixed in 2.4.3-p3.
CVE-2022-24086Critical 9.8 · KEV
Adobe Commerce checkout improper input validation leads to remote code execution
Affected: from 2.3.3-p1, fixed in 2.3.7-p3; from 2.4.0, fixed in 2.4.3-p2.
CVE-2021-39864Medium 6.5
Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition
Affected: from 2.4.2-p1, through 2.4.2-p2; versions 2.4.3; fixed in 2.3.7-p2; versions 2.4.2.
CVE-2021-28567Medium 5.0
Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission
Affected: from 2.4.0, fixed in 2.4.2-p1; fixed in 2.3.7.
CVE-2021-28566Low 3.7
Magento Commerce information disclosure during upload action leveraging a specially crafted file
Affected: from 2.4.0, fixed in 2.4.2-p1; from 2.3.0, fixed in 2.3.7.
CVE-2021-36044High 7.5
Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service
Affected: versions 2.4.2; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.3.7; fixed in 2.3.7-p1.
CVE-2021-36027Medium 6.5
Magento Commerce Stored Cross-site Scripting Vulnerability
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36043High 8.0
Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36042Critical 9.1
Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution
Affected: versions 2.4.2; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.3.7; fixed in 2.3.7-p1.
CVE-2021-36030High 7.5
Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36041Critical 9.1
Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36040Critical 9.1
Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Affected: versions 2.4.2; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.3.7; fixed in 2.3.7-p1.
CVE-2021-36025Critical 9.1
Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36020High 8.2
Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36024Critical 9.1
Magento Commerce Improper Neutralization of Special Elements Used In A Command
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36031High 7.2
Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36039Medium 6.5
Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36029Critical 9.1
Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36026Medium 6.5
Magento Commerce Stored Cross-site Scripting Vulnerability
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36032High 8.3
Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36038Medium 6.5
Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36028Critical 9.1
Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36034Critical 9.1
Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Affected: versions 2.4.2; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.3.7; fixed in 2.3.7-p1.
CVE-2021-36022Critical 9.1
Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36033Critical 9.1
Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-36037Medium 6.5
Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure
Affected: versions 2.4.2; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.3.7; fixed in 2.3.7-p1.
CVE-2021-36012Medium 6.5
Magento Commerce Gift Card Business Logic Error
Affected: fixed in 2.3.7-p1; versions 2.3.7; from 2.4.2-p1, fixed in 2.4.2-p2; versions 2.4.2.
CVE-2021-28584Medium 5.4
Magento Commerce path traversal vulnerability in child theme store creation
Affected: from 2.4.0, fixed in 2.4.2-p1; fixed in 2.3.7.
CVE-2021-28585Medium 5.3
Magento Commerce improper input validation in customer customer webapi
Affected: from 2.4.0, fixed in 2.4.2-p1; fixed in 2.3.7.
CVE-2021-28583High 7.5
Magento Commerce insecure storage of sensitive documentation
Affected: from 2.4.0, fixed in 2.4.2-p1; fixed in 2.3.7.
CVE-2021-28563Medium 6.5
Magento Commerce improper Authorization via the 'Create Customer' endpoint
Affected: from 2.4.0, fixed in 2.4.2-p1; fixed in 2.3.7.
CVE-2021-28556Medium 6.9
Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution
Affected: from 2.4.0, fixed in 2.4.2-p1; fixed in 2.3.7.
CVE-2021-21014Critical 9.1
Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.2.
CVE-2021-21016Critical 9.1
Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.2.
CVE-2021-21025Critical 9.1
Magento Commerce XML Injection Could Lead To Arbitrary Code Execution
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21018Critical 9.1
Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21032Medium 5.6
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Affected: from 2.4.0, fixed in 2.4.1-p1; fixed in 2.3.6.
CVE-2021-21029Medium 4.8
Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.2.
CVE-2021-21015High 8.0
Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.2.
CVE-2021-21019Critical 9.1
Magento Commerce XML Injection Could Lead To Remote Code Execution
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21020Medium 5.3
Magento Commerce Improper Access Control Vulnerability
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21024Critical 9.1
Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21026Medium 5.3
Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.2.
CVE-2021-21023Medium 4.8
Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21022Medium 5.3
Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21030High 8.1
Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1-p1.
CVE-2021-21027Medium 4.3
Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification
Affected: fixed in 2.3.6-p1; from 2.4.0, fixed in 2.4.2.
CVE-2021-21031Medium 5.6
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Affected: from 2.4.0, fixed in 2.4.1-p1; fixed in 2.3.6.
CVE-2020-24404Low 2.7
Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1.
CVE-2020-24407Critical 9.1
Arbitrary code execution via file import functionality
Affected: fixed in 2.4.1.
CVE-2020-24406Low 3.7
Document root path disclosure on Maintenance page
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1.
CVE-2020-24405Medium 4.3
Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1.
CVE-2020-24403Low 2.7
Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1.
CVE-2020-24401Medium 6.5
Incorrect permissions following the deletion of a user role or deactivation of a user
Affected: fixed in 2.4.1.
CVE-2020-24402Medium 4.9
Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1.
CVE-2020-24400High 7.1
SQL injection allows arbitrary read from database
Affected: fixed in 2.3.6; from 2.4.0, fixed in 2.4.1.
CVE-2020-24408Medium 6.1
Stored XSS in customer address upload feature
Affected: fixed in 2.4.1.
CVE-2020-9691Unrated
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability.
Affected: fixed in 2.3.5-p2.
CVE-2020-9692Unrated
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability.
Affected: fixed in 2.3.5-p2.
CVE-2020-9690Unrated
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability.
Affected: fixed in 2.3.5-p2.
CVE-2020-9689Unrated
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability.
Affected: fixed in 2.3.5-p2.
CVE-2020-9577Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…
Affected: fixed in 2.3.4-p2.
CVE-2020-9576Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: from 2.3.0, fixed in 2.3.4-p2; fixed in 2.2.12.
CVE-2020-9588Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing…
Affected: fixed in 2.3.4-p2.
CVE-2020-9578Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9631Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: from 2.3.0, fixed in 2.3.4-p2; through 2.2.11.
CVE-2020-9630Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9591Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth…
Affected: from 2.3.0, fixed in 2.3.4-p2; through 2.2.11.
CVE-2020-9632Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9580Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9581Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9582Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: from 2.3.0, fixed in 2.3.4-p2; fixed in 2.2.12.
CVE-2020-9583Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9587Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9584Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…
Affected: from 2.3.0, fixed in 2.3.4-p2; fixed in 2.2.12.
CVE-2020-9579Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-9585Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth…
Affected: through 2.2.11; from 2.3.0, fixed in 2.3.4-p2.
CVE-2020-3758Unrated
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting…
Affected: from 2.3.0, fixed in 2.3.4; fixed in 2.2.11.
CVE-2020-3719Unrated
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability.
Affected: from 2.3.0, fixed in 2.3.4; fixed in 2.2.11.
CVE-2020-3718Unrated
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability.
Affected: from 2.3.0, fixed in 2.3.4; fixed in 2.2.11.
CVE-2020-3717Unrated
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability.
Affected: from 2.2.0, fixed in 2.2.11; from 2.3.0, fixed in 2.3.4.
CVE-2020-3716Unrated
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted…
Affected: from 2.2.0, fixed in 2.2.11; from 2.3.0, fixed in 2.3.4.
CVE-2020-3715Unrated
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting…
Affected: from 2.3.0, fixed in 2.3.4; fixed in 2.2.11.
CVE-2019-8132Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8145Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8158Unrated
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8157Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8156Unrated
A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8159Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8232Unrated
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an…
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8233Unrated
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a…
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.3.
CVE-2019-8154Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8153Unrated
A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8152Unrated
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10…
Affected: from 2.2.0, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8151Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8150Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8149Unrated
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8148Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8147Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8146Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8144Unrated
A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.3, fixed in 2.3.2-p1.
CVE-2019-8143Unrated
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8142Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8141Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3.
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8140Unrated
An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8139Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8138Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8137Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8136Unrated
An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8135Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8134Unrated
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8133Unrated
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8131Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8130Unrated
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8129Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8128Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8127Unrated
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8126Unrated
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8124Unrated
An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior…
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8123Unrated
An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19…
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8122Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3.
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8121Unrated
An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.3.
CVE-2019-8120Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to…
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8119Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3.
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8118Unrated
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed…
Affected: from 2.1.0, fixed in 2.1.19; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-8117Unrated
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8115Unrated
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8114Unrated
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to…
Affected: fixed in 1.9.4.3; from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p2.
CVE-2019-8113Unrated
Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the…
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8112Unrated
A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8111Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8110Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8109Unrated
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8108Unrated
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p2.
CVE-2019-8107Unrated
An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8093Unrated
An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2, fixed in 2.2.10; from 2.3, fixed in 2.3.2-p1.
CVE-2019-8092Unrated
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.2-p1.
CVE-2019-8090Unrated
An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3.
Affected: from 2.2.0, fixed in 2.2.10; from 2.3.0, fixed in 2.3.3.
CVE-2019-7853Unrated
A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7951Unrated
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7950Unrated
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7947Unrated
A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7945Unrated
A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7944Unrated
A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7942Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7939Unrated
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7938Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7937Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7936Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.3.0, fixed in 2.3.2; from 2.2.0, fixed in 2.2.9; from 2.1.0, fixed in 2.1.18.
CVE-2019-7935Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7934Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7932Unrated
A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7930Unrated
A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7929Unrated
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7928Unrated
A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7927Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7926Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7925Unrated
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7923Unrated
A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7921Unrated
A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7915Unrated
A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7913Unrated
A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7912Unrated
A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7911Unrated
A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7909Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7908Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7904Unrated
Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7903Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7899Unrated
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7898Unrated
Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7897Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7896Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7895Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7892Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7890Unrated
An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7889Unrated
An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7888Unrated
An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7887Unrated
A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7886Unrated
A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7885Unrated
Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7882Unrated
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7881Unrated
A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7880Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7877Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7876Unrated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7875Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7874Unrated
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7873Unrated
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7872Unrated
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7871Unrated
A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7869Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7868Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7867Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7866Unrated
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7865Unrated
A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7864Unrated
An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7863Unrated
A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento…
Affected: from 2.1, fixed in 2.1.18; from 2.2, fixed in 2.2.9; from 2.3, fixed in 2.3.2.
CVE-2019-7862Unrated
A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7861Unrated
Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7860Unrated
A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7859Unrated
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7858Unrated
A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7857Unrated
A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can…
Affected: from 2.2.0, fixed in 2.2.9; from 2.1.0, fixed in 2.1.18; from 2.3.0, fixed in 2.3.2.
CVE-2019-7855Unrated
A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7854Unrated
An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7852Unrated
A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7851Unrated
A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7849Unrated
A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules.
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2019-7139Unrated
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive…
Affected: from 2.1.0, fixed in 2.1.18; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.2.
CVE-2018-5301Unrated
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer…
Affected: fixed in 2.0.10; from 2.1.0, fixed in 2.1.2.
CVE-2016-6485Unrated
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the…
Affected: from 2.0, fixed in 2.2.6.