p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de magento/community-edition · Page n° 6

Vulnérabilité publiée pour magento/community-edition au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 360

  1. GHSA-prpf-cj87-hwvr

    Non évaluéeCorrectif disponible

    Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities

    Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more. Key Security Improvements: - APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML - APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only) - APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module) - APPSEC-2029: PHP Object Injection and Remote Code Execution

    magento/community-editionPHP
    • Mettez à jour vers 1.9.3.9
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2024-20758

    Critique · CVSS 9EPSS 1,42%Correctif disponible

    Adobe Commerce | Improper Input Validation (CWE-20)

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p8
    • Mettez à jour vers 2.4.5-p7
    • Mettez à jour vers 2.4.6-p5
    • Mettez à jour vers 2.4.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2024-20759

    Élevée · CVSS 8.1EPSS 1,03%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p8
    • Mettez à jour vers 2.4.5-p7
    • Mettez à jour vers 2.4.6-p5
    • Mettez à jour vers 2.4.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2024-20716

    Moyenne · CVSS 4.9EPSS 0,87%Correctif disponible

    Force high-usage of resources by generating unlimited coupons: Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the application to slow down or crash. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p7
    • Mettez à jour vers 2.4.5-p6
    • Mettez à jour vers 2.4.6-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2024-20718

    Moyenne · CVSS 4.3EPSS 0,76%Correctif disponible

    [Spain] CSRF to delete Requisition Lists at Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p7
    • Mettez à jour vers 2.4.5-p6
    • Mettez à jour vers 2.4.6-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2024-20719

    Critique · CVSS 9.1EPSS 1,31%Correctif disponible

    [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p7
    • Mettez à jour vers 2.4.5-p6
    • Mettez à jour vers 2.4.6-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2024-20720

    Critique · CVSS 9.1EPSS 3,69%Correctif disponible

    Command injection in data collector backup due to insufficient patching of CVE-2023-38208

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p7
    • Mettez à jour vers 2.4.5-p6
    • Mettez à jour vers 2.4.6-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2023-38251

    Moyenne · CVSS 5.3EPSS 0,76%Correctif disponible

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2023-38219

    Élevée · CVSS 8.7EPSS 0,75%Correctif disponible

    Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2023-38220

    Élevée · CVSS 7.5EPSS 0,8%Correctif disponible

    Full page cache enumeration via cookie X-Magento-Vary

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2023-26367

    Moyenne · CVSS 4.9EPSS 0,8%Correctif disponible

    Error based file extraction via PHP filter chains during product bulk import logic

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  12. CVE-2023-26366

    Moyenne · CVSS 6.8EPSS 0,86%Correctif disponible

    Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  13. CVE-2023-38218

    Élevée · CVSS 8.8EPSS 0,88%Correctif disponible

    Incorrect Authorization - Customer account takeover

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2023-38250

    Élevée · CVSS 8EPSS 0,83%Correctif disponible

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2023-38249

    Élevée · CVSS 8EPSS 0,83%Correctif disponible

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  16. CVE-2023-38221

    Élevée · CVSS 8EPSS 0,83%Correctif disponible

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p6
    • Mettez à jour vers 2.4.5-p5
    • Mettez à jour vers 2.4.6-p3
    • Mettez à jour vers 2.4.7-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  17. CVE-2022-24093

    Critique · CVSS 9.1EPSS 1,51%Correctif disponible

    Adobe Commerce post-auth improper input validation leads to remote code execution

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.3.7-p3
    • Mettez à jour vers 2.4.3-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  18. CVE-2021-36036

    Élevée · CVSS 7.2EPSS 2,12%Correctif disponible

    Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.3.7-p1
    • Mettez à jour vers 2.4.2-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  19. CVE-2021-36021

    Élevée · CVSS 7.2EPSS 2,01%Correctif disponible

    Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.3.7-p1
    • Mettez à jour vers 2.4.2-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  20. CVE-2021-36023

    Critique · CVSS 9.1EPSS 2,37%Correctif disponible

    Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.3.7-p1
    • Mettez à jour vers 2.4.2-p2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →