- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 161 · 24 critical, 44 high, 68 medium, 7 low
- Registry
- Packagist
Advisories 161
- CVE-2025-54267Medium 6.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-54266Medium 4.8
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-54263High 8.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-54265Medium 5.9
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-54264High 8.1
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-54236Critical 9.1 · KEV
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.0.2.
- CVE-2025-49556High 7.5
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-49557High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-49558Medium 5.9
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: through 2.0.2.
- CVE-2025-49554High 7.5
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.0.2.
- CVE-2025-49559Medium 5.3
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.0.2.
- CVE-2025-49555High 8.1
Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)
Affected: through 2.0.2.
- CVE-2025-49550Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-49549Low 2.7
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-27206Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
Show all 161 advisoriesShow fewer advisories
- CVE-2025-43585High 8.2
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.0.2.
- CVE-2025-27190Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2025-27191Medium 5.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2025-27192Low 2.7
Adobe Commerce | Insufficiently Protected Credentials (CWE-522)
Affected: through 2.0.2.
- CVE-2025-24414High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24437Medium 5.4
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-24434Critical 9.1
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-24415High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24411High 8.1
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2025-24416High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24413High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24432Low 3.7
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: through 2.0.2.
- CVE-2025-24424Medium 6.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2025-24430Low 3.7
Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Affected: through 2.0.2.
- CVE-2025-24429Low 3.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2025-24436Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-24438High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24406High 7.5
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Affected: through 2.0.2.
- CVE-2025-24417High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24409High 8.2
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-24425Medium 5.3
Adobe Commerce | Business Logic Errors (CWE-840)
Affected: through 2.0.2.
- CVE-2025-24421Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2025-24412High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24427Medium 6.5
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2025-24428Medium 5.4
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24410High 8.7
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2025-24408Medium 6.5
Adobe Commerce | Information Exposure (CWE-200)
Affected: through 2.0.2.
- CVE-2025-24435Medium 4.3
Adobe Commerce | Improper Access Control (CWE-284)
Affected: through 2.0.2.
- CVE-2024-39419Medium 4.3
A user without ship permissions can ship the orders
Affected: through 2.0.2.
- CVE-2024-39403High 7.6
Stored XSS through Webhook module public key configuration
Affected: through 2.0.2.
- CVE-2024-39418Medium 5.4
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.0.2.
- CVE-2024-39413Medium 4.3
An unauthorized user can export the Invoiced Sales Report
Affected: through 2.0.2.
- CVE-2024-39399High 7.7
[Paris] Path Traversal lead to local file read
Affected: through 2.0.2.
- CVE-2024-39417Medium 4.3
An unauthorized user can export the Shipping Report
Affected: through 2.0.2.
- CVE-2024-39407Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.0.2.
- CVE-2024-39398High 7.4
OTP 2FA can be bruteforced
Affected: through 2.0.2.
- CVE-2024-39401High 8.4
Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: through 2.0.2.
- CVE-2024-39411Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.0.2.
- CVE-2024-39416Medium 4.3
Unauthorized user can export Orders Sale Report
Affected: through 2.0.2.
- CVE-2024-39414Medium 4.3
Being able to import/export tax rates without proper privileges
Affected: through 2.0.2.
- CVE-2024-39402High 8.4
Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: through 2.0.2.
- CVE-2024-39400High 8.1
DOM XSS through integrations can impact other admins
Affected: through 2.0.2.
- CVE-2024-39404Medium 4.3
A user without Shop Policy Parameters section privilege can alter the shop policy parameters section
Affected: through 2.0.2.
- CVE-2024-39415Medium 4.3
An unauthorized user can export the Tax Sales Report
Affected: through 2.0.2.
- CVE-2024-39405Medium 4.3
Adobe Commerce | Improper Authorization (CWE-285)
Affected: through 2.0.2.
- CVE-2024-20758Critical 9.0
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.0.2.
- CVE-2024-20759High 8.1
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Affected: through 2.0.2.
- CVE-2024-20716Medium 4.9
Force high-usage of resources by generating unlimited coupons: Adobe Commerce
Affected: through 2.0.2.
- CVE-2024-20718Medium 4.3
[Spain] CSRF to delete Requisition Lists at Adobe Commerce
Affected: through 2.0.2.
- CVE-2024-20719Critical 9.1
[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297
Affected: through 2.0.2.
- CVE-2024-20720Critical 9.1
Command injection in data collector backup due to insufficient patching of CVE-2023-38208
Affected: through 2.0.2.
- CVE-2023-38251Medium 5.3
Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
Affected: through 2.0.2.
- CVE-2023-38219High 8.7
Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping
Affected: through 2.0.2.
- CVE-2023-38220High 7.5
Full page cache enumeration via cookie X-Magento-Vary
Affected: through 2.0.2.
- CVE-2023-26367Medium 4.9
Error based file extraction via PHP filter chains during product bulk import logic
Affected: through 2.0.2.
- CVE-2023-26366Medium 6.8
Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)
Affected: through 2.0.2.
- CVE-2023-38218High 8.8
Incorrect Authorization - Customer account takeover
Affected: through 2.0.2.
- CVE-2023-38250High 8.0
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected: through 2.0.2.
- CVE-2023-38249High 8.0
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected: through 2.0.2.
- CVE-2023-38221High 8.0
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Affected: through 2.0.2.
- CVE-2022-24093Critical 9.1
Adobe Commerce post-auth improper input validation leads to remote code execution
Affected: through 2.0.2.
- CVE-2021-36036High 7.2
Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36021High 7.2
Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36023Critical 9.1
Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2023-38207High 7.5
Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read
Affected: through 2.0.2.
- CVE-2023-38208Critical 9.1
Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Affected: through 2.0.2.
- CVE-2023-38209Medium 6.5
Adobe Commerce Incorrect Authorization Security feature bypass
Affected: through 2.0.2.
- CVE-2023-29297Critical 9.1
Admin-to-admin stored XSS via cache poisoning
Affected: through 2.0.2.
- CVE-2023-29296Medium 4.3
[Cloud] Customer suspects IDOR vulnerability
Affected: through 2.0.2.
- CVE-2023-29295Medium 4.3
Insecure Direct Object Reference (IDOR) in Create Quote Function
Affected: through 2.0.2.
- CVE-2023-29294Medium 4.3
Bypass Purchase Order Approval using Company User in Adobe Commerce B2B
Affected: through 2.0.2.
- CVE-2023-29293Low 2.7
Adobe Commerce | Improper Input Validation (CWE-20)
Affected: through 2.0.2.
- CVE-2023-29292Medium 4.9
Server Side Request Forgery (SSRF) in FedEx carrier integration configuration
Affected: through 2.0.2.
- CVE-2023-29291Medium 4.9
Server Side Request Forgery (SSRF) in USPS carrier integration configuration
Affected: through 2.0.2.
- CVE-2023-29290Medium 5.3
Adobe Commerce Guest Cart Shipping Address Overwrite IDOR
Affected: through 2.0.2.
- CVE-2023-29289Medium 6.5
Adobe Commerce XML Injection Security feature bypass
Affected: through 2.0.2.
- CVE-2023-29288Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Affected: through 2.0.2.
- CVE-2023-29287Medium 5.3
Adobe Commerce Information Exposure Security feature bypass
Affected: through 2.0.2.
- CVE-2023-22248High 7.5
Adobe Commerce Incorrect Authorization Security feature bypass
Affected: through 2.0.2.
- CVE-2023-22251Medium 4.3
Adobe Commerce Incorrect Authorization Security feature bypass
Affected: through 2.0.2.
- CVE-2023-22250Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: through 2.0.2.
- CVE-2023-22247High 7.5
Adobe Commerce XML Injection Arbitrary file system read
Affected: through 2.0.2.
- CVE-2022-35689Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: through 2.0.2.
- CVE-2022-35698Critical 10.0
Adobe Commerce Stored XSS Arbitrary code execution
Affected: through 2.0.2.
- CVE-2022-35692Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Affected: through 2.0.2.
- CVE-2021-39864Medium 6.5
Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition
Affected: through 2.0.2.
- CVE-2021-28567Medium 5.0
Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission
Affected: through 2.0.2.
- CVE-2021-36044High 7.5
Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service
Affected: through 2.0.2.
- CVE-2021-36027Medium 6.5
Magento Commerce Stored Cross-site Scripting Vulnerability
Affected: through 2.0.2.
- CVE-2021-36043High 8.0
Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36042Critical 9.1
Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36030High 7.5
Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation
Affected: through 2.0.2.
- CVE-2021-36041Critical 9.1
Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36040Critical 9.1
Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36025Critical 9.1
Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36020High 8.2
Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36024Critical 9.1
Magento Commerce Improper Neutralization of Special Elements Used In A Command
Affected: through 2.0.2.
- CVE-2021-36031High 7.2
Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36039Medium 6.5
Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure
Affected: through 2.0.2.
- CVE-2021-36029Critical 9.1
Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36026Medium 6.5
Magento Commerce Stored Cross-site Scripting Vulnerability
Affected: through 2.0.2.
- CVE-2021-36032High 8.3
Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation
Affected: through 2.0.2.
- CVE-2021-36038Medium 6.5
Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure
Affected: through 2.0.2.
- CVE-2021-36028Critical 9.1
Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36034Critical 9.1
Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36022Critical 9.1
Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36033Critical 9.1
Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution
Affected: through 2.0.2.
- CVE-2021-36037Medium 6.5
Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure
Affected: through 2.0.2.
- CVE-2021-36012Medium 6.5
Magento Commerce Gift Card Business Logic Error
Affected: through 2.0.2.
- CVE-2021-28584Medium 5.4
Magento Commerce path traversal vulnerability in child theme store creation
Affected: through 2.0.2.
- CVE-2021-28585Medium 5.3
Magento Commerce improper input validation in customer customer webapi
Affected: through 2.0.2.
- CVE-2021-28583High 7.5
Magento Commerce insecure storage of sensitive documentation
Affected: through 2.0.2.
- CVE-2021-28556Medium 6.9
Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution
Affected: through 2.0.2.
- CVE-2021-21014Critical 9.1
Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
Affected: through 2.0.2.
- CVE-2021-21016Critical 9.1
Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
Affected: through 2.0.2.
- CVE-2021-21025Critical 9.1
Magento Commerce XML Injection Could Lead To Arbitrary Code Execution
Affected: through 2.0.2.
- CVE-2021-21032Medium 5.6
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Affected: through 2.0.2.
- CVE-2021-21020Medium 5.3
Magento Commerce Improper Access Control Vulnerability
Affected: through 2.0.2.
- CVE-2021-21026Medium 5.3
Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Affected: through 2.0.2.
- CVE-2021-21023Medium 4.8
Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution
Affected: through 2.0.2.
- CVE-2021-21022Medium 5.3
Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Affected: through 2.0.2.
- CVE-2021-21030High 8.1
Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution
Affected: through 2.0.2.
- CVE-2021-21027Medium 4.3
Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification
Affected: through 2.0.2.
- CVE-2021-21031Medium 5.6
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Affected: through 2.0.2.
- CVE-2020-24407Critical 9.1
Arbitrary code execution via file import functionality
Affected: through 2.0.2.
- CVE-2020-24403Low 2.7
Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Affected: through 2.0.2.
- CVE-2020-24401Medium 6.5
Incorrect permissions following the deletion of a user role or deactivation of a user
Affected: through 2.0.2.
- CVE-2020-24402Medium 4.9
Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
Affected: through 2.0.2.
- CVE-2020-9691Unrated
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability.
Affected: through 2.0.2.
- CVE-2020-9689Unrated
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability.
Affected: through 2.0.2.
- CVE-2020-9577Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…
Affected: through 2.0.2.
- CVE-2020-9576Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: through 2.0.2.
- CVE-2020-9588Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing…
Affected: through 2.0.2.
- CVE-2020-9578Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: through 2.0.2.
- CVE-2020-9631Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: through 2.0.2.
- CVE-2020-9630Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic…
Affected: through 2.0.2.
- CVE-2020-9632Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: through 2.0.2.
- CVE-2020-9580Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…
Affected: through 2.0.2.
- CVE-2020-9581Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…
Affected: through 2.0.2.
- CVE-2020-9582Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: through 2.0.2.
- CVE-2020-9583Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…
Affected: through 2.0.2.
- CVE-2020-9587Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization…
Affected: through 2.0.2.
- CVE-2020-9584Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…
Affected: through 2.0.2.
- CVE-2020-9585Unrated
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth…
Affected: through 2.0.2.
- CVE-2019-8114Unrated
A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to…
Affected: fixed in 1.9.4.3.
- CVE-2016-6485Unrated
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the…
Affected: from 2.0, through 2.0.2.