p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de magento/community-edition · Page n° 5

Vulnérabilité publiée pour magento/community-edition au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 360

  1. CVE-2024-39412

    Moyenne · CVSS 4.3EPSS 0,43%Correctif disponible

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and perform a minor integrity change. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2024-39402

    Élevée · CVSS 8.4EPSS 1,67%Correctif disponible

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2024-39406

    Moyenne · CVSS 6.8EPSS 0,87%Correctif disponible

    Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2024-39400

    Élevée · CVSS 8.1EPSS 0,7%Correctif disponible

    DOM XSS through integrations can impact other admins

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2024-39404

    Moyenne · CVSS 4.3EPSS 0,46%Correctif disponible

    A user without Shop Policy Parameters section privilege can alter the shop policy parameters section

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2024-39415

    Moyenne · CVSS 4.3EPSS 0,44%Correctif disponible

    An unauthorized user can export the Tax Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2024-39405

    Moyenne · CVSS 4.3EPSS 0,43%Correctif disponible

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p10
    • Mettez à jour vers 2.4.5-p9
    • Mettez à jour vers 2.4.6-p7
    • Mettez à jour vers 2.4.7-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2024-34106

    Moyenne · CVSS 5.3EPSS 0,85%Correctif disponible

    Insecure Direct Object Reference - An attacker can able to erase the victim quote details

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2024-34103

    Élevée · CVSS 8.1EPSS 0,91%Correctif disponible

    Customer account takeover via web API call & subsequent password reset

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2024-34111

    Moyenne · CVSS 6.5EPSS 1,27%Correctif disponible

    SSRF in service connector

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2024-34107

    Moyenne · CVSS 5.3EPSS 1,13%Correctif disponible

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  12. CVE-2024-34105

    Moyenne · CVSS 4.8EPSS 0,67%Correctif disponible

    Stored Cross Site Scripting in Order Comment

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  13. CVE-2024-34104

    Élevée · CVSS 8.2EPSS 0,79%Correctif disponible

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2024-34102

    Critique · CVSS 9.8EPSS 99,99%Dans le catalogue KEVCode d’exploitation publicCorrectif disponible

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p9
    • Mettez à jour vers 2.4.5-p8
    • Mettez à jour vers 2.4.6-p6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. GHSA-8j7c-682x-r9f2

    Non évaluéeCorrectif disponible

    Magento RCE,XSS and other vulnerabilities

    Magento Commerce and Open Source 2.3.0, 2.2.7 and 2.1.16 contain multiple security enhancements that help close Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.1.16
    • Mettez à jour vers 2.2.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. GHSA-5gmh-85x8-5cx7

    Non évaluéeCorrectif disponible

    Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

    Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.1.14
    • Mettez à jour vers 2.2.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. GHSA-cv25-3pxr-4q7x

    Non évaluéeCorrectif disponible

    Magento Open Source Security Advisory: Patch SUPEE-10975

    Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated: - PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication - MAG-23: M1 Credit Card Storage Capability - PRODSECBUG-2149: Authenticated RCE using customer import - PRODSECBUG-2159: API Based RCE Vulnerability - PRODSECBUG-2156: RCE Via Unauthorized Upload - PRODSECBUG-2155: Authenticated RCE using dataflow - PRODSECBUG-2053:

    magento/community-editionPHP
    • Mettez à jour vers 1.14.4.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. GHSA-26hq-7286-mg8f

    Non évaluéeCorrectif disponible

    Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

    Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to: - use sendmail as the mail transport agent - have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).

    magento/community-editionPHP
    • Mettez à jour vers 1.14.3.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. GHSA-6wm4-3rjj-c8xx

    Non évaluéeCorrectif disponible

    Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities

    SUPEE-10975, Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

    magento/community-editionPHP
    • Mettez à jour vers 1.9.4.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →