Latest magento magento Vulnerabilities

● CVE-2021-36036
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing...
Magento Magento<2.3.7
Magento Magento<2.3.7
Magento Magento>=2.4.0<2.4.2
Magento Magento>=2.4.0<2.4.2
Magento Magento=2.3.7
Magento Magento=2.3.7
and 4 more
● CVE-2021-36021
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authent...
Magento Magento<2.3.7
Magento Magento<2.3.7
Magento Magento>=2.4.0<2.4.2
Magento Magento>=2.4.0<2.4.2
Magento Magento=2.3.7
Magento Magento=2.3.7
and 4 more
● CVE-2021-36023
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privil...
Magento Magento<2.3.7
Magento Magento<2.3.7
Magento Magento>=2.4.0<2.4.2
Magento Magento>=2.4.0<2.4.2
Magento Magento=2.3.7
Magento Magento=2.3.7
and 4 more
● CVE-2022-42344
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an inse...
Adobe Commerce<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
and 37 more
● CVE-2022-34258
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker wit...
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
composer/magento/community-edition>=2.3.0<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-34257
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to ...
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
composer/magento/community-edition>=2.3.0<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-34256
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An att...
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
composer/magento/community-edition>=2.3.0<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-34254
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnera...
composer/magento/community-edition=2.4.4
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.3.0<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-34255
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An at...
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
composer/magento/community-edition>=2.3.0<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-34259
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. ...
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
composer/magento/community-edition>=2.3.0<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-34253
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges c...
composer/magento/community-edition>=2.4.0<2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
composer/magento/community-edition<2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
and 17 more
● CVE-2022-24086
Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability
Adobe Commerce and Magento Open Source
composer/magento/community-edition>=2.4.0<2.4.3-p2
composer/magento/community-edition>=2.3.3-p1<2.3.7-p3
Adobe Commerce<2.3.0
Adobe Commerce>2.3.3<=2.3.6
Adobe Commerce>=2.4.0<=2.4.2
and 11 more
● CVE-2021-28567
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could...
composer/magento/community-edition<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
Magento Magento<=2.4.2
Magento Magento<=2.4.2
● CVE-2021-28566
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image....
composer/magento/community-edition>=2.3.0<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
Magento Magento<=2.4.2
Magento Magento<=2.4.2
● CVE-2021-28584
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation co...
composer/magento/community-edition<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 8 more
● CVE-2021-28583
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful ex...
composer/magento/community-edition<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 8 more
● CVE-2021-28585
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation co...
composer/magento/community-edition<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 8 more
● CVE-2021-28563
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitat...
composer/magento/community-edition<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
Magento Magento<2.3.7
Magento Magento<2.3.7
Magento Magento>=2.4.0<=2.4.2
Magento Magento>=2.4.0<=2.4.2
● CVE-2021-28556
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation...
Magento Magento<2.3.7
Magento Magento<2.3.7
Magento Magento>=2.4.0<=2.4.2
Magento Magento>=2.4.0<=2.4.2
composer/magento/community-edition<2.3.7
composer/magento/community-edition>=2.4.0<2.4.2-p1
● CVE-2021-21014
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution ...
composer/magento/community-edition>=2.4.0<2.4.2
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21025
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code...
composer/magento/community-edition>=2.4.0<2.4.1-p1
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21027
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation coul...
composer/magento/community-edition>=2.4.0<2.4.2
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21020
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation c...
composer/magento/community-edition>=2.4.0<2.4.1-p1
composer/magento/community-edition<2.3.6
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21022
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could l...
composer/magento/community-edition>=2.4.0<2.4.1-p1
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21019
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code executi...
composer/magento/community-edition>=2.4.0<2.4.1-p1
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21018
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to ar...
composer/magento/community-edition>=2.4.0<2.4.1-p1
composer/magento/community-edition<2.3.6
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21026
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could l...
composer/magento/community-edition>=2.4.0<2.4.2
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21032
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access...
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
Magento Magento=2.4.0
Magento Magento=2.4.0
and 4 more
● CVE-2021-21023
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could l...
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
Magento Magento=2.4.0
Magento Magento=2.4.0
and 4 more
● CVE-2021-21024
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to una...
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
Magento Magento=2.4.0
Magento Magento=2.4.0
and 4 more
● CVE-2021-21030
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitati...
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
Magento Magento=2.4.0
Magento Magento=2.4.0
and 4 more
● CVE-2021-21029
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could ...
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
Magento Magento=2.4.0
Magento Magento=2.4.0
and 6 more
● CVE-2021-21016
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution ...
composer/magento/community-edition>=2.4.0<2.4.2
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2021-21015
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could...
composer/magento/community-edition>=2.4.0<2.4.2
composer/magento/community-edition<2.3.6-p1
Magento Magento<2.3.6
Magento Magento<2.3.6
Magento Magento=2.3.6
Magento Magento=2.3.6
and 6 more
● CVE-2020-24401
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator rem...
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
Magento Magento=2.3.5-p1
and 2 more
● CVE-2020-24402
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with per...
composer/magento/community-edition=2.4.0
composer/magento/community-edition<2.3.6
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
and 4 more
● CVE-2020-24403
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users wi...
composer/magento/community-edition=2.4.0
composer/magento/community-edition<2.3.6
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
and 4 more
● CVE-2020-24405
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modif...
composer/magento/community-edition>=2.4.0<2.4.1
composer/magento/community-edition<=2.3.5-p2
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
and 4 more
● CVE-2020-24407
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated ...
composer/magento/community-edition<=2.4.0
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
and 3 more
● CVE-2020-24406
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This i...
composer/magento/community-edition=2.4.0
composer/magento/community-edition<2.3.6
Magento Magento<=2.3.4
Magento Magento<=2.3.4
Magento Magento=2.4.0
Magento Magento=2.4.0
● CVE-2020-24404
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions t...
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
Magento Magento=2.3.5-p1
and 2 more
● CVE-2020-24400
Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authentic...
composer/magento/community-edition=2.4.0
composer/magento/community-edition<2.3.6
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
and 2 more
● CVE-2020-24408
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could...
Magento Magento<=2.3.4
Magento Magento<=2.3.4
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
Magento Magento=2.3.5-p1
and 2 more
● CVE-2020-9692
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
composer/magento/community-edition<2.3.5-p2
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
and 1 more
● CVE-2020-9689
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
composer/magento/community-edition<2.3.5-p2
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
and 1 more
● CVE-2020-9691
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.
composer/magento/community-edition<2.3.5-p2
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
and 1 more
● CVE-2020-9690
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.
composer/magento/community-edition<2.3.5-p2
Magento Magento<2.3.5
Magento Magento<2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5
Magento Magento=2.3.5-p1
and 1 more
● CVE-2020-9665
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
composer/magento/core<=1.9.4.5
Magento Magento<=1.9.4.5
Magento Magento<=1.14.4.5
● CVE-2020-9664
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.
composer/magento/core<=1.9.4.5
Magento Magento<=1.9.4.5
Magento Magento<=1.14.4.5
● CVE-2020-9585
Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation coul...
composer/magento/core<1.9.4.5
composer/magento/community-edition>=2.3.0<2.3.4-p2
composer/magento/community-edition<=2.2.11
Magento Magento<=1.9.4.4
Magento Magento<=1.14.4.4
Magento Magento>=2.2.0<=2.2.11
and 3 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203