p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости magento/community-edition · Страница 10

За последние 30 дней в magento/community-edition опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 360

  1. CVE-2021-28556

    Средний · CVSS 6.9EPSS 1,4%Есть исправление

    Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

    Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.7
    • Обновитесь до 2.4.2-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  2. CVE-2021-21014

    Критический · CVSS 9.1EPSS 4,21%Есть исправление

    Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  3. CVE-2021-21016

    Критический · CVSS 9.1EPSS 4,85%Есть исправление

    Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  4. CVE-2021-21025

    Критический · CVSS 9.1EPSS 3,27%Есть исправление

    Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  5. CVE-2021-21018

    Критический · CVSS 9.1EPSS 3,99%Есть исправление

    Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  6. CVE-2021-21032

    Средний · CVSS 5.6EPSS 1,56%Есть исправление

    Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  7. CVE-2021-21029

    Средний · CVSS 4.8EPSS 84,64%Есть исправление

    Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  8. CVE-2021-21015

    Высокий · CVSS 8EPSS 2,93%Есть исправление

    Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  9. CVE-2021-21019

    Критический · CVSS 9.1EPSS 3,64%Есть исправление

    Magento Commerce XML Injection Could Lead To Remote Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  10. CVE-2021-21020

    Средний · CVSS 5.3EPSS 2,41%Есть исправление

    Magento Commerce Improper Access Control Vulnerability

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  11. CVE-2021-21024

    Критический · CVSS 9.1EPSS 2,77%Есть исправление

    Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  12. CVE-2021-21026

    Средний · CVSS 5.3EPSS 1,81%Есть исправление

    Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  13. CVE-2021-21023

    Средний · CVSS 4.8EPSS 1,61%Есть исправление

    Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  14. CVE-2021-21022

    Средний · CVSS 5.3EPSS 2,2%Есть исправление

    Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  15. CVE-2021-21030

    Высокий · CVSS 8.1EPSS 5,62%Есть исправление

    Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  16. CVE-2021-21027

    Средний · CVSS 4.3EPSS 1,66%Есть исправление

    Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6-p1
    • Обновитесь до 2.4.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  17. CVE-2021-21031

    Средний · CVSS 5.6EPSS 1,67%Есть исправление

    Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1-p1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  18. CVE-2020-24404

    Низкий · CVSS 2.7EPSS 1,87%Есть исправление

    Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  19. CVE-2020-24407

    Критический · CVSS 9.1EPSS 5,27%Есть исправление

    Arbitrary code execution via file import functionality

    Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

    magento/community-editionPHP
    • Обновитесь до 2.4.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  20. CVE-2020-24406

    Низкий · CVSS 3.7EPSS 2,08%Есть исправление

    Document root path disclosure on Maintenance page

    When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable vulnerabilities in the environment.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.6
    • Обновитесь до 2.4.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →