p PatchFirst

PatchFirst · Latest vulnerabilities

magento/core vulnerabilities

Vulnerabilities published for magento/core in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 24

  2. CVE-2020-9665

    Medium · CVSS 6.1EPSS 1.43%No fix published

    CVE-2020-9665

    Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    magento/corePHP
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2020-9577

    Medium · CVSS 6.1EPSS 1.5%Fix available

    CVE-2020-9577

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2020-9576

    Critical · CVSS 9.8EPSS 5.72%Fix available

    CVE-2020-9576

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2020-9588

    High · CVSS 7.2EPSS 2.92%Fix available

    CVE-2020-9588

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2020-9578

    Critical · CVSS 9.8EPSS 5.72%Fix available

    CVE-2020-9578

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2020-9631

    Critical · CVSS 9.8EPSS 7.4%Fix available

    CVE-2020-9631

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2020-9630

    Critical · CVSS 9.8EPSS 3.95%Fix available

    CVE-2020-9630

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation could lead to privilege escalation.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2020-9591

    High · CVSS 7.5EPSS 3.43%Fix available

    CVE-2020-9591

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2020-9632

    Critical · CVSS 9.8EPSS 7.4%Fix available

    CVE-2020-9632

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2020-9580

    Critical · CVSS 9.8EPSS 5.04%Fix available

    CVE-2020-9580

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2020-9581

    Medium · CVSS 6.1EPSS 1.5%Fix available

    CVE-2020-9581

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2020-9582

    Critical · CVSS 9.8EPSS 5.72%Fix available

    CVE-2020-9582

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2020-9583

    Critical · CVSS 9.8EPSS 5.72%Fix available

    CVE-2020-9583

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2020-9587

    High · CVSS 7.5EPSS 5.01%Fix available

    CVE-2020-9587

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitation could lead to potentially unauthorized product discounts.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2020-9584

    Medium · CVSS 5.4EPSS 1.17%Fix available

    CVE-2020-9584

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2020-9579

    Critical · CVSS 9.8EPSS 5.04%Fix available

    CVE-2020-9579

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2020-9585

    Critical · CVSS 9.8EPSS 4.95%Fix available

    CVE-2020-9585

    Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to arbitrary code execution.

    magento/corePHP
    • Update to 1.9.4.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2020-3719

    High · CVSS 7.5EPSS 3.16%Fix available

    CVE-2020-3719

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

    magento/corePHP
    • Update to 1.9.4.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2020-3715

    Medium · CVSS 6.1EPSS 1.84%Fix available

    CVE-2020-3715

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    magento/corePHP
    • Update to 1.9.4.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →