# magento/core (Packagist) vulnerabilities 24 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/magento/core ## Advisories (24) ### [CVE-2020-9664](https://cve.now/CVE-2020-9664): Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. - Severity: Unrated - Published: Jul 22, 2020 - Affected: through 1.9.4.5. ### [CVE-2020-9665](https://cve.now/CVE-2020-9665): Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. - Severity: Unrated - Published: Jul 22, 2020 - Affected: through 1.9.4.5. ### [CVE-2020-9577](https://cve.now/CVE-2020-9577): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9576](https://cve.now/CVE-2020-9576): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9588](https://cve.now/CVE-2020-9588): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9578](https://cve.now/CVE-2020-9578): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9631](https://cve.now/CVE-2020-9631): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9630](https://cve.now/CVE-2020-9630): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9591](https://cve.now/CVE-2020-9591): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9632](https://cve.now/CVE-2020-9632): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9580](https://cve.now/CVE-2020-9580): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9581](https://cve.now/CVE-2020-9581): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9582](https://cve.now/CVE-2020-9582): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9583](https://cve.now/CVE-2020-9583): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9587](https://cve.now/CVE-2020-9587): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9584](https://cve.now/CVE-2020-9584): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9579](https://cve.now/CVE-2020-9579): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-9585](https://cve.now/CVE-2020-9585): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth… - Severity: Unrated - Published: Jun 26, 2020 - Affected: fixed in 1.9.4.5. ### [CVE-2020-3719](https://cve.now/CVE-2020-3719): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. - Severity: Unrated - Published: Jan 29, 2020 - Affected: fixed in 1.9.4.4. ### [CVE-2020-3715](https://cve.now/CVE-2020-3715): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting… - Severity: Unrated - Published: Jan 29, 2020 - Affected: fixed in 1.9.4.4. ### [CVE-2015-6497](https://cve.now/CVE-2015-6497): The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise… - Severity: Unrated - Published: Jan 15, 2020 - Affected: fixed in 1.9.2.1. ### [CVE-2019-8227](https://cve.now/CVE-2019-8227): In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject… - Severity: Unrated - Published: Nov 6, 2019 - Affected: fixed in 1.9.4.3. ### [CVE-2019-8230](https://cve.now/CVE-2019-8230): In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration… - Severity: Unrated - Published: Nov 5, 2019 - Affected: fixed in 1.9.4.3. ### [CVE-2019-8231](https://cve.now/CVE-2019-8231): In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can… - Severity: Unrated - Published: Nov 5, 2019 - Affected: fixed in 1.9.4.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/magento/core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.