p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости magento/community-edition · Страница 6

За последние 30 дней в magento/community-edition опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 360

  1. GHSA-prpf-cj87-hwvr

    Без оценкиЕсть исправление

    Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities

    Magento Commerce 1.14.3.9 and Open Source 1.9.3.9 bring essential security enhancements with Patch SUPEE-10752. These updates address various vulnerabilities, including authenticated Admin user remote code execution (RCE), cross-site request forgery (CSRF), and more. Key Security Improvements: - APPSEC-2001: Authenticated Remote Code Execution (RCE) using custom layout XML - APPSEC-2015: Authenticated Remote Code Execution (RCE) through the Create New Order feature (Commerce only) - APPSEC-2042: PHP Object Injection and RCE in the Magento admin panel (Commerce Target Rule module) - APPSEC-2029: PHP Object Injection and Remote Code Execution

    magento/community-editionPHP
    • Обновитесь до 1.9.3.9
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2024-20758

    Критический · CVSS 9EPSS 1,42%Есть исправление

    Adobe Commerce | Improper Input Validation (CWE-20)

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p8
    • Обновитесь до 2.4.5-p7
    • Обновитесь до 2.4.6-p5
    • Обновитесь до 2.4.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  3. CVE-2024-20759

    Высокий · CVSS 8.1EPSS 1,03%Есть исправление

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p8
    • Обновитесь до 2.4.5-p7
    • Обновитесь до 2.4.6-p5
    • Обновитесь до 2.4.7
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  4. CVE-2024-20716

    Средний · CVSS 4.9EPSS 0,87%Есть исправление

    Force high-usage of resources by generating unlimited coupons: Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the application to slow down or crash. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p7
    • Обновитесь до 2.4.5-p6
    • Обновитесь до 2.4.6-p4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  5. CVE-2024-20718

    Средний · CVSS 4.3EPSS 0,76%Есть исправление

    [Spain] CSRF to delete Requisition Lists at Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction, typically in the form of the victim clicking a link or visiting a malicious website.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p7
    • Обновитесь до 2.4.5-p6
    • Обновитесь до 2.4.6-p4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  6. CVE-2024-20719

    Критический · CVSS 9.1EPSS 1,31%Есть исправление

    [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p7
    • Обновитесь до 2.4.5-p6
    • Обновитесь до 2.4.6-p4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  7. CVE-2024-20720

    Критический · CVSS 9.1EPSS 3,69%Есть исправление

    Command injection in data collector backup due to insufficient patching of CVE-2023-38208

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p7
    • Обновитесь до 2.4.5-p6
    • Обновитесь до 2.4.6-p4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  8. CVE-2023-38251

    Средний · CVSS 5.3EPSS 0,76%Есть исправление

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  9. CVE-2023-38219

    Высокий · CVSS 8.7EPSS 0,75%Есть исправление

    Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  10. CVE-2023-38220

    Высокий · CVSS 7.5EPSS 0,8%Есть исправление

    Full page cache enumeration via cookie X-Magento-Vary

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  11. CVE-2023-26367

    Средний · CVSS 4.9EPSS 0,8%Есть исправление

    Error based file extraction via PHP filter chains during product bulk import logic

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  12. CVE-2023-26366

    Средний · CVSS 6.8EPSS 0,86%Есть исправление

    Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction, scope is changed due to the fact that an attacker can enforce file read outside the application's path boundary.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  13. CVE-2023-38218

    Высокий · CVSS 8.8EPSS 0,88%Есть исправление

    Incorrect Authorization - Customer account takeover

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  14. CVE-2023-38250

    Высокий · CVSS 8EPSS 0,83%Есть исправление

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  15. CVE-2023-38249

    Высокий · CVSS 8EPSS 0,83%Есть исправление

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  16. CVE-2023-38221

    Высокий · CVSS 8EPSS 0,83%Есть исправление

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and attack complexity is high as it requires knowledge of tooling beyond just using the UI.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.4.4-p6
    • Обновитесь до 2.4.5-p5
    • Обновитесь до 2.4.6-p3
    • Обновитесь до 2.4.7-beta2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  17. CVE-2022-24093

    Критический · CVSS 9.1EPSS 1,51%Есть исправление

    Adobe Commerce post-auth improper input validation leads to remote code execution

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.7-p3
    • Обновитесь до 2.4.3-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  18. CVE-2021-36036

    Высокий · CVSS 7.2EPSS 2,12%Есть исправление

    Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.7-p1
    • Обновитесь до 2.4.2-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  19. CVE-2021-36021

    Высокий · CVSS 7.2EPSS 2,01%Есть исправление

    Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.7-p1
    • Обновитесь до 2.4.2-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  20. CVE-2021-36023

    Критический · CVSS 9.1EPSS 2,37%Есть исправление

    Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Обновитесь до 2.3.7-p1
    • Обновитесь до 2.4.2-p2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →