p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости magento/community-edition · Страница 5

За последние 30 дней в magento/community-edition опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 360

  1. CVE-2024-39412

    Средний · CVSS 4.3EPSS 0,43%Есть исправление

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and perform a minor integrity change. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  2. CVE-2024-39402

    Высокий · CVSS 8.4EPSS 1,67%Есть исправление

    Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  3. CVE-2024-39406

    Средний · CVSS 6.8EPSS 0,87%Есть исправление

    Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  4. CVE-2024-39400

    Высокий · CVSS 8.1EPSS 0,7%Есть исправление

    DOM XSS through integrations can impact other admins

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  5. CVE-2024-39404

    Средний · CVSS 4.3EPSS 0,46%Есть исправление

    A user without Shop Policy Parameters section privilege can alter the shop policy parameters section

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  6. CVE-2024-39415

    Средний · CVSS 4.3EPSS 0,44%Есть исправление

    An unauthorized user can export the Tax Sales Report

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  7. CVE-2024-39405

    Средний · CVSS 4.3EPSS 0,43%Есть исправление

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p10
    • Обновитесь до 2.4.5-p9
    • Обновитесь до 2.4.6-p7
    • Обновитесь до 2.4.7-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  8. CVE-2024-34106

    Средний · CVSS 5.3EPSS 0,85%Есть исправление

    Insecure Direct Object Reference - An attacker can able to erase the victim quote details

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  9. CVE-2024-34103

    Высокий · CVSS 8.1EPSS 0,91%Есть исправление

    Customer account takeover via web API call & subsequent password reset

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  10. CVE-2024-34111

    Средний · CVSS 6.5EPSS 1,27%Есть исправление

    SSRF in service connector

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  11. CVE-2024-34107

    Средний · CVSS 5.3EPSS 1,13%Есть исправление

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  12. CVE-2024-34105

    Средний · CVSS 4.8EPSS 0,67%Есть исправление

    Stored Cross Site Scripting in Order Comment

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  13. CVE-2024-34104

    Высокий · CVSS 8.2EPSS 0,79%Есть исправление

    Adobe Commerce | Improper Authorization (CWE-285)

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  14. CVE-2024-34102

    Критический · CVSS 9.8EPSS 99,99%В каталоге KEVПубличный эксплойтЕсть исправление

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p9
    • Обновитесь до 2.4.5-p8
    • Обновитесь до 2.4.6-p6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. GHSA-8j7c-682x-r9f2

    Без оценкиЕсть исправление

    Magento RCE,XSS and other vulnerabilities

    Magento Commerce and Open Source 2.3.0, 2.2.7 and 2.1.16 contain multiple security enhancements that help close Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.1.16
    • Обновитесь до 2.2.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. GHSA-mcfc-67vm-j568

    Без оценкиЕсть исправление

    Magento Cross-Site Scripting (XSS) vulnerability

    Magento Commerce and Open Source 2.2.6 and 2.1.15 contain multiple security enhancements that help close Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.1.15
    • Обновитесь до 2.2.6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. GHSA-5gmh-85x8-5cx7

    Без оценкиЕсть исправление

    Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities

    Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.

    magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.1.14
    • Обновитесь до 2.2.5
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. GHSA-cv25-3pxr-4q7x

    Без оценкиЕсть исправление

    Magento Open Source Security Advisory: Patch SUPEE-10975

    Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated: - PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication - MAG-23: M1 Credit Card Storage Capability - PRODSECBUG-2149: Authenticated RCE using customer import - PRODSECBUG-2159: API Based RCE Vulnerability - PRODSECBUG-2156: RCE Via Unauthorized Upload - PRODSECBUG-2155: Authenticated RCE using dataflow - PRODSECBUG-2053:

    magento/community-editionPHP
    • Обновитесь до 1.14.4.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. GHSA-26hq-7286-mg8f

    Без оценкиЕсть исправление

    Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

    Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to: - use sendmail as the mail transport agent - have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).

    magento/community-editionPHP
    • Обновитесь до 1.14.3.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. GHSA-6wm4-3rjj-c8xx

    Без оценкиЕсть исправление

    Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities

    SUPEE-10975, Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

    magento/community-editionPHP
    • Обновитесь до 1.9.4.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →