p PatchFirst

PatchFirst · Свежие уязвимости

magento/project-community-edition 2.0.0-rc2: известные уязвимости · Страница 5

Известных уязвимостей, затрагивающих magento/project-community-edition 2.0.0-rc2: 160. Сравните исправленные версии ниже с установленной у вас.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 160

  1. CVE-2023-38208

    Критический · CVSS 9.1EPSS 2,55%Нет опубликованного исправления

    Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  2. CVE-2023-38209

    Средний · CVSS 6.5EPSS 0,97%Нет опубликованного исправления

    Adobe Commerce Incorrect Authorization Security feature bypass

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  3. CVE-2023-29297

    Критический · CVSS 9.1EPSS 1,35%Нет опубликованного исправления

    Admin-to-admin stored XSS via cache poisoning

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  4. CVE-2023-29296

    Средний · CVSS 4.3EPSS 0,65%Нет опубликованного исправления

    [Cloud] Customer suspects IDOR vulnerability

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  5. CVE-2023-29295

    Средний · CVSS 4.3EPSS 0,65%Нет опубликованного исправления

    Insecure Direct Object Reference (IDOR) in Create Quote Function

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  6. CVE-2023-29294

    Средний · CVSS 4.3EPSS 0,74%Нет опубликованного исправления

    Bypass Purchase Order Approval using Company User in Adobe Commerce B2B

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  7. CVE-2023-29293

    Низкий · CVSS 2.7EPSS 1,01%Нет опубликованного исправления

    Adobe Commerce | Improper Input Validation (CWE-20)

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An admin privileged attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  8. CVE-2023-29292

    Средний · CVSS 4.9EPSS 0,95%Нет опубликованного исправления

    Server Side Request Forgery (SSRF) in FedEx carrier integration configuration

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  9. CVE-2023-29291

    Средний · CVSS 4.9EPSS 1,09%Нет опубликованного исправления

    Server Side Request Forgery (SSRF) in USPS carrier integration configuration

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  10. CVE-2023-29290

    Средний · CVSS 5.3EPSS 0,63%Нет опубликованного исправления

    Adobe Commerce Guest Cart Shipping Address Overwrite IDOR

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  11. CVE-2023-29289

    Средний · CVSS 6.5EPSS 0,88%Нет опубликованного исправления

    Adobe Commerce XML Injection Security feature bypass

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  12. CVE-2023-29288

    Средний · CVSS 4.3EPSS 0,65%Нет опубликованного исправления

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  13. CVE-2023-29287

    Средний · CVSS 5.3EPSS 0,71%Нет опубликованного исправления

    Adobe Commerce Information Exposure Security feature bypass

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  14. CVE-2023-22248

    Высокий · CVSS 7.5EPSS 1,02%Нет опубликованного исправления

    Adobe Commerce Incorrect Authorization Security feature bypass

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  15. CVE-2023-22251

    Средний · CVSS 4.3EPSS 0,56%Нет опубликованного исправления

    Adobe Commerce Incorrect Authorization Security feature bypass

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  16. CVE-2023-22250

    Средний · CVSS 5.3EPSS 0,96%Нет опубликованного исправления

    Adobe Commerce Improper Access Control Security feature bypass

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  17. CVE-2023-22247

    Высокий · CVSS 7.5EPSS 0,93%Нет опубликованного исправления

    Adobe Commerce XML Injection Arbitrary file system read

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  18. CVE-2022-35689

    Средний · CVSS 5.3EPSS 1,41%Нет опубликованного исправления

    Adobe Commerce Improper Access Control Security feature bypass

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  19. CVE-2022-35698

    Критический · CVSS 10.0EPSS 14,58%Нет опубликованного исправления

    Adobe Commerce Stored XSS Arbitrary code execution

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  20. CVE-2022-35692

    Средний · CVSS 5.3EPSS 0,84%Нет опубликованного исправления

    Adobe Commerce Improper Access Control Security feature bypass

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.

    magento/project-community-editionPHP
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →