Search for packages
| purl | pkg:composer/magento/community-edition@2.3.0 |
| Next non-vulnerable version | 2.4.6-p9 |
| Latest non-vulnerable version | 2.4.9-alpha3 |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-r355-75hw-r8jf
Aliases: CVE-2025-54265 |
Magento allows incorrect authorization Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization … |
Vulnerable |
|
GHSA-qvwr-p3hj-j6jf
Aliases: CVE-2025-54267 |
Magento vulnerable to privilege escalation due to incorrect authorization Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are … |
Vulnerable |
|
GHSA-2768-5wmv-cfff
Aliases: CVE-2025-54264 |
Magento vulnerable to stored Cross-Site Scripting (XSS) Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by … |
Vulnerable |
|
GHSA-pcrx-r49h-x2w5
Aliases: CVE-2025-54266 |
Magento vulnerable to stored Cross-Site Scripting (XSS) Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by … |
Vulnerable |
|
GHSA-69x9-xp2j-w8g8
Aliases: CVE-2025-54263 |
Magento provides incorrect authorization through a security feature bypass Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are … |
Vulnerable |
|
GHSA-rr2g-rrjj-xw86
Aliases: CVE-2025-27188 |
Magento Improper Authorization vulnerability Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability … |
Vulnerable |
|
GHSA-6wq7-cg9h-mj6q
Aliases: CVE-2025-27190 |
Magento Improper Access Control leads to Security feature bypass Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected … |
Vulnerable |
|
GHSA-2r94-wm5v-4prx
Aliases: CVE-2025-27192 |
Magento does not properly protect credentials Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently … |
Vulnerable |
|
GHSA-vhcq-4xrm-2cr2
Aliases: CVE-2025-27191 |
Magento Improper Access Control leads to Security feature bypass Magento versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected … |
Vulnerable |
|
GHSA-6ff8-jrfg-43hh
Aliases: CVE-2025-24425 |
Magento Business Logic Error vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business … |
Vulnerable |
|
GHSA-rjjw-g6hw-7pc9
Aliases: CVE-2025-24416 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-v6r2-425c-hfrr
Aliases: CVE-2025-24421 |
Magento Incorrect Authorization vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization … |
Vulnerable |
|
GHSA-g3j6-9753-8mp2
Aliases: CVE-2025-24417 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-xwgx-8v72-4j5j
Aliases: CVE-2025-24413 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-3cfg-w257-cgf8
Aliases: CVE-2025-24408 |
Magento Information Exposure vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure … |
Vulnerable |
|
GHSA-gjxp-46rq-wg4q
Aliases: CVE-2025-24410 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-469f-wf4f-3jjv
Aliases: CVE-2025-24437 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-vw47-79jv-3598
Aliases: CVE-2025-24409 |
Adobe Commerce Improper Authorization vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-gc27-rvvm-q77r
Aliases: CVE-2025-24415 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-82p4-55gj-956p
Aliases: CVE-2025-24435 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-8884-7rm9-mrx4
Aliases: CVE-2025-24438 |
Magento stored Cross-Site Scripting (XSS) vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-7jmr-43qj-pw47
Aliases: CVE-2025-24432 |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by … |
Vulnerable |
|
GHSA-mm87-rrqx-94cr
Aliases: CVE-2025-24428 |
Magento stored Cross-Site Scripting (XSS) vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-v3hq-g424-5mgg
Aliases: CVE-2025-24427 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-539v-w87w-w62c
Aliases: CVE-2025-24424 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-954p-ff72-327w
Aliases: CVE-2025-24406 |
Adobe Commerce Path Traversal Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation … |
Vulnerable |
|
GHSA-36hw-x3cc-m258
Aliases: CVE-2025-24411 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-656q-fx2w-8ccv
Aliases: CVE-2025-24429 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-6w27-c66f-gvhq
Aliases: CVE-2025-24430 |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by … |
Vulnerable |
|
GHSA-fppq-f2m6-xv5c
Aliases: CVE-2025-24434 |
Improper Authorization vulnerability in Magento and Adobe Commerce Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected … |
Vulnerable |
|
GHSA-fhw6-3mj5-w9gv
Aliases: CVE-2025-24414 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-m4rg-mpp2-97px
Aliases: CVE-2025-24412 |
Magento Stored Cross-Site Scripting (XSS) Vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a … |
Vulnerable |
|
GHSA-ghpr-6qhr-rpp8
Aliases: CVE-2025-24436 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-g2pj-xmxq-3r9q
Aliases: CVE-2025-27206 |
Magento Improper Access Control leads to security feature bypass Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are … |
Vulnerable |
|
GHSA-85jx-x9r4-45m2
Aliases: CVE-2025-49549 |
Magento Authenticated Security feature bypass Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization … |
Vulnerable |
|
GHSA-r487-9vv5-75gg
Aliases: CVE-2025-43585 |
Magento Improper Authorization leading to security feature bypass Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by … |
Vulnerable |
|
GHSA-j934-vjh5-vf9r
Aliases: CVE-2025-47110 |
Magneto contains stored XSS vulnerability Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site … |
Vulnerable |
|
GHSA-8hcx-xvww-6c6h
Aliases: CVE-2025-49550 |
Magento Security feature bypass Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability … |
Vulnerable |
|
GHSA-8mq8-c243-2335
Aliases: CVE-2025-49557 |
Magento Cross-site Scripting vulnerability Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored … | There are no reported fixed by versions. |
|
GHSA-5777-jj7p-mpqw
Aliases: CVE-2025-49555 |
Magento Cross-Site Request Forgery (CSRF) vulnerability Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a … |
Vulnerable |
|
GHSA-wcmw-8xpp-rwfj
Aliases: CVE-2025-49558 |
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by … |
Vulnerable |
|
GHSA-h4f4-gv6h-x824
Aliases: CVE-2025-49559 |
Magento vulnerable to path traversal Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-7hrj-3c9x-xv5h
Aliases: CVE-2025-49556 |
Magento has incorrect authorization issue that leads to arbitrary file system read Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 … |
Vulnerable |
|
GHSA-xgfm-992v-h2hr
Aliases: CVE-2025-49554 |
Magento vulnerable to denial of service Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an … |
Vulnerable |
|
GHSA-wh92-6q6g-px7j
Aliases: CVE-2025-54236 |
Magento Community Edition Improper Input Validation vulnerability Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected … | There are no reported fixed by versions. |
|
GHSA-297f-r9w7-w492
Aliases: CVE-2022-42344 |
Magento Improper input validation vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected … |
Vulnerable |
|
GHSA-hvf5-4jr9-fghh
Aliases: CVE-2020-24402 |
Magento incorrect permissions vulnerability in the Integrations component Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect … |
Vulnerable |
|
GHSA-55gv-hfg3-hwjq
Aliases: CVE-2020-9585 |
Magento Defense-in-depth security mitigation vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-gfcq-wh3g-c6h4
Aliases: CVE-2019-8110 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … | There are no reported fixed by versions. |
|
GHSA-v8fg-p27h-mxjp
Aliases: CVE-2019-8147 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-8wm7-h2qh-ff4c
Aliases: CVE-2020-9587 |
Magento authorization bypass vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-j2r4-2cr6-h3r3
Aliases: CVE-2020-9588 |
Magento Signature verification bypass Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-w942-fw92-mqm2
Aliases: CVE-2021-28566 |
Magento Information Disclosure vulnerability Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an … |
Vulnerable |
|
GHSA-j2jp-58gv-g2pg
Aliases: CVE-2020-9580 |
Magento Security mitigation bypass vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-7pxg-6p87-8c9v
Aliases: CVE-2020-24407 |
Magento 2 Community Edition RCE via Unsafe File Upload Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an … |
Vulnerable |
|
GHSA-rv48-v862-mp92
Aliases: CVE-2021-21018 |
Magento OS Command Injection Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS … |
Vulnerable |
|
GHSA-94wq-87g6-8h77
Aliases: CVE-2021-39864 |
Magento Open Source allows Cross-Site Request Forgery (CSRF) Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and … |
Vulnerable |
|
GHSA-6w29-x5j4-qhrw
Aliases: CVE-2020-9632 |
Magento security mitigation bypass vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-rwf7-652f-76mv
Aliases: CVE-2020-24404 |
Magento 2 Community Edition vulnerable to Improper Authorization Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect … |
Vulnerable |
|
GHSA-p7m7-j8jv-393q
Aliases: CVE-2020-24405 |
Magento incorrect permissions vulnerability in the Inventory module Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect … |
Vulnerable |
|
GHSA-36xq-7w8w-xp68
Aliases: CVE-2021-36043 |
Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and … |
Vulnerable |
|
GHSA-h4xc-577p-hgj9
Aliases: CVE-2021-21027 |
Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 … |
Vulnerable |
|
GHSA-2w2x-7qgj-4x78
Aliases: CVE-2020-9581 |
Magento stored cross-site scripting vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-6m27-3r8q-c7f7
Aliases: CVE-2019-8146 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … |
Vulnerable |
|
GHSA-xgp9-j48h-jjf9
Aliases: CVE-2020-9690 |
Magento observable timing discrepancy vulnerability Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. … |
Vulnerable |
|
GHSA-6988-g89m-27vf
Aliases: CVE-2021-21030 |
Magento stored cross-site scripting (XSS) in the customer address upload feature Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and … |
Vulnerable |
|
GHSA-985w-mqqp-7287
Aliases: CVE-2019-8120 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento … |
Vulnerable |
|
GHSA-689w-2f93-2x67
Aliases: CVE-2020-9577 |
Magento stored cross-site scripting vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-56hf-w8gm-448q
Aliases: CVE-2019-8092 |
Magento 2 Community Edition XSS Vulnerability A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-7gh6-f4jh-3crq
Aliases: CVE-2021-28583 |
Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) … |
Vulnerable |
|
GHSA-8gfq-m4cf-w975
Aliases: CVE-2021-36026 |
Magento stored cross-site scripting vulnerability in the customer address upload feature Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) … |
Vulnerable |
|
GHSA-c3m4-hxv9-4mxj
Aliases: CVE-2020-9582 |
Magento command injection vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-724x-gqhv-9c5x
Aliases: CVE-2020-9578 |
Magento command injection vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-cc3w-r3w8-hfh7
Aliases: CVE-2021-28567 |
Magento Improper Authorization vulnerability in the customers module Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) … |
Vulnerable |
|
GHSA-32x5-6p4q-q8jh
Aliases: CVE-2019-8093 |
Magento Information Disclosure via File upload functionality An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-4f7x-gjqc-qqpg
Aliases: CVE-2020-9576 |
Magento command injection vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-x72m-p4qc-p7rv
Aliases: CVE-2019-8109 |
Magento 2 Community Edition RCE Vulnerability via CSRF A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, … | There are no reported fixed by versions. |
|
GHSA-3g7m-g8qm-x6j5
Aliases: CVE-2021-36039 |
Magento discloses sensitive information Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by … |
Vulnerable |
|
GHSA-vx7m-v8v2-fhwm
Aliases: CVE-2019-8131 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-2j6v-829g-885q
Aliases: CVE-2021-21020 |
Magento Improper Access Control Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an … |
Vulnerable |
|
GHSA-jjmg-xmq2-g6ff
Aliases: CVE-2019-8152 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 … |
Vulnerable |
|
GHSA-653q-vqm6-gmjm
Aliases: CVE-2019-8090 |
Magento 2 Community Edition Arbitrary File Deletion An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento … |
Vulnerable |
|
GHSA-86pc-6mm8-542r
Aliases: CVE-2019-8148 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or … |
Vulnerable |
|
GHSA-jwxh-wj79-ccm6
Aliases: CVE-2021-21029 |
Magento Reflected Cross-site Scripting vulnerability via 'file' parameter Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) … |
Vulnerable |
|
GHSA-2cg3-w597-rjfv
Aliases: CVE-2019-8107 |
Magento 2 Community Edition Arbitrary File Deletion An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-vrw4-34p5-pjg5
Aliases: CVE-2019-8157 |
Magento Cross-Site Scripting via admin panel A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-85xw-3hp5-6fmc
Aliases: CVE-2019-8138 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-8p5c-f836-m4h7
Aliases: CVE-2019-8158 |
Magento 2 Community Edition XML Injection An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … |
Vulnerable |
|
GHSA-p783-gj6m-9r88
Aliases: CVE-2019-8150 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … |
Vulnerable |
|
GHSA-wgpr-9675-8r67
Aliases: CVE-2021-36038 |
Magento discloses sensitive information via the Multishipping Module Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and … |
Vulnerable |
|
GHSA-8mwx-wpp4-5xh4
Aliases: CVE-2019-8149 |
Magento Broken authentication and session managememt Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-vqg7-8v6x-54rq
Aliases: CVE-2020-9692 |
Magento security mitigation bypass vulnerability Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. … |
Vulnerable |
|
GHSA-92ph-xm9v-cg3j
Aliases: CVE-2019-8108 |
Magento Broken authentication and session managememt Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … |
Vulnerable |
|
GHSA-mhwc-4w67-xq2c
Aliases: CVE-2019-8128 |
Magento Cross-Site Scripting via store name A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-jrjx-8gmw-jj2q
Aliases: CVE-2019-8137 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … | There are no reported fixed by versions. |
|
GHSA-45h4-6gcj-6hwv
Aliases: CVE-2020-9584 |
Magento Stored cross-site scripting Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-9wc9-498w-h8xv
Aliases: CVE-2020-3716 |
Magento deserialization vulnerability Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a … |
Vulnerable |
|
GHSA-775w-gx3f-4j4f
Aliases: CVE-2019-8156 |
Magento 2 Community Edition SSRF vulnerability A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … |
Vulnerable |
|
GHSA-x2v2-2jhp-c5hv
Aliases: CVE-2021-36027 |
Magento stored cross-site scripting vulnerability Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected … |
Vulnerable |
|
GHSA-3f97-7pgv-gmgr
Aliases: CVE-2021-36012 |
Magento affected by a business logic error in the placeOrder graphql mutation Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and … |
Vulnerable |
|
GHSA-f73h-224c-62qr
Aliases: CVE-2019-8151 |
Magento Server-Side Request Forgery (SSRF) A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … |
Vulnerable |
|
GHSA-298q-wv2h-v5vw
Aliases: CVE-2019-8142 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-3x9x-vhqj-cv27
Aliases: CVE-2021-36022 |
Magento XML Injection vulnerability in the Widgets Update Layout Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 … |
Vulnerable |
|
GHSA-94q8-gx29-6mqv
Aliases: CVE-2019-8143 |
Magento Injection vulnerability via email templates A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … | There are no reported fixed by versions. |
|
GHSA-7gpv-xrjr-f5h4
Aliases: CVE-2021-28584 |
Magento Path Traversal vulnerability Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a … |
Vulnerable |
|
GHSA-q9xx-4689-gvv5
Aliases: CVE-2021-28563 |
Magento Unauthorized access to restricted resources Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected … |
Vulnerable |
|
GHSA-gjjm-4x3g-3h33
Aliases: CVE-2019-8139 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or … | There are no reported fixed by versions. |
|
GHSA-j46h-qjjv-cxfj
Aliases: CVE-2021-36034 |
Magento affected by remote code execution via a file upload Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and … |
Vulnerable |
|
GHSA-c38m-9668-6j2w
Aliases: CVE-2021-28585 |
Magento Improper input validation vulnerability Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by … |
Vulnerable |
|
GHSA-9wr9-fw9v-8fgr
Aliases: CVE-2019-8141 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 … |
Vulnerable |
|
GHSA-qmq6-jpvg-j547
Aliases: CVE-2021-36024 |
Magento is affected by an os command injection via the Data collection endpoint Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 … |
Vulnerable |
|
GHSA-792f-c8mp-2cr5
Aliases: CVE-2021-21016 |
Magento OS command injection via the WebAPI Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are … |
Vulnerable |
|
GHSA-mr8q-7f5j-wc79
Aliases: CVE-2020-24406 |
Magento information disclosure vulnerability When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information … |
Vulnerable |
|
GHSA-x42g-82pp-4v6g
Aliases: CVE-2019-8130 |
Magento SQL injection vulnerability A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 … | There are no reported fixed by versions. |
|
GHSA-gffx-9f36-r8wp
Aliases: CVE-2020-9631 |
Magento security mitigation bypass vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-crjc-2v9m-8w7r
Aliases: CVE-2021-21026 |
Magento improper authorization vulnerability in the integrations module Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) … |
Vulnerable |
|
GHSA-j63v-wcf9-c9hm
Aliases: CVE-2019-8119 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 … |
Vulnerable |
|
GHSA-39rw-4m66-82gf
Aliases: CVE-2020-24403 |
Magento incorrect user permissions vulnerability within the Inventory component Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an … |
Vulnerable |
|
GHSA-5vw8-r55w-f4q4
Aliases: CVE-2021-36032 |
Magento is affected by an improper input validation vulnerability Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 … |
Vulnerable |
|
GHSA-273r-v888-vgc6
Aliases: CVE-2019-8153 |
Magento Cross-site Scripting (XSS) A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento … |
Vulnerable |
|
GHSA-4v2q-hjx3-c4vr
Aliases: CVE-2019-8154 |
Magento remote code execution vulnerability A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … |
Vulnerable |
|
GHSA-jxjc-6xmh-h7mg
Aliases: CVE-2020-24408 |
Magento 2 Community Edition XSS Vulnerability Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability … |
Vulnerable |
|
GHSA-vpg9-gq7j-mxqg
Aliases: CVE-2019-8144 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. … | There are no reported fixed by versions. |
|
GHSA-2crc-5vq6-386r
Aliases: CVE-2019-8111 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … | There are no reported fixed by versions. |
|
GHSA-4jfq-f8hc-775q
Aliases: CVE-2021-21032 |
Magento Insufficient Session Expiration Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate … |
Vulnerable |
|
GHSA-39ch-rg26-gmq5
Aliases: CVE-2021-28556 |
Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) … |
Vulnerable |
|
GHSA-wr57-3h2f-3q95
Aliases: CVE-2021-36044 |
Magento affected by a server-side denial-of-service using a GraphQL field Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and … |
Vulnerable |
|
GHSA-mw95-gmw4-883p
Aliases: CVE-2021-21019 |
Magento XML injection in the Widgets module Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are … |
Vulnerable |
|
GHSA-xvpx-6hh8-7h72
Aliases: CVE-2021-36020 |
Magento XML Injection vulnerability in the 'City' field Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and … |
Vulnerable |
|
GHSA-rhff-65hp-55rw
Aliases: CVE-2021-36030 |
Magento allows attackers to alter the price of items Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 … |
Vulnerable |
|
GHSA-mx5m-j5xr-jg8c
Aliases: CVE-2021-36041 |
Magento vulnerable to file upload attack Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are … |
Vulnerable |
|
GHSA-xgcp-59g2-wm8g
Aliases: CVE-2019-8136 |
Magento 2 Community Edition Insecure Component An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … | There are no reported fixed by versions. |
|
GHSA-47h6-hfpv-7phj
Aliases: CVE-2019-8159 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … |
Vulnerable |
|
GHSA-7pr3-34rg-g53m
Aliases: CVE-2019-8140 |
Magento Unrestricted file upload vulnerability An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … |
Vulnerable |
|
GHSA-v99w-jxr4-w6mc
Aliases: CVE-2019-8117 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-m8wx-whpp-q283
Aliases: CVE-2021-36029 |
Magento improper authorization vulnerability Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by … |
Vulnerable |
|
GHSA-45gj-78hc-4mvc
Aliases: CVE-2019-8134 |
Magento SQL injection via marketing account with access to email templates variables A SQL injection vulnerability exists in Magento 2.2 … | There are no reported fixed by versions. |
|
GHSA-g378-6fg4-gx3v
Aliases: CVE-2019-8132 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-c4r2-3f9r-rwp8
Aliases: CVE-2019-8113 |
Magento 2 Community Weak PRNG Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak … | There are no reported fixed by versions. |
|
GHSA-g7pc-799q-743f
Aliases: CVE-2020-9691 |
Magento DOM-based Cross-site scripting vulnerability Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. … |
Vulnerable |
|
GHSA-f2g3-3c6q-4478
Aliases: CVE-2020-24401 |
Magento 2 Community Edition Incorrect Authorization Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. … |
Vulnerable |
|
GHSA-c55h-7q4j-g6rq
Aliases: CVE-2020-9583 |
Magento command injection vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and … |
Vulnerable |
|
GHSA-2pq5-gpqf-g4r3
Aliases: CVE-2021-36040 |
Magento has a file extension restrictions bypass Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) … |
Vulnerable |
|
GHSA-874g-pxqp-frqp
Aliases: CVE-2020-3717 |
Magento Path Traversal Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a … |
Vulnerable |
|
GHSA-6vc8-3xf2-qrxx
Aliases: CVE-2019-8232 |
Magento 2 Community Edition RCE Vulnerability In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, … | There are no reported fixed by versions. |
|
GHSA-h5rm-m772-6qcx
Aliases: CVE-2021-21023 |
Magento stored cross-site scripting vulnerability in the admin console Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and … |
Vulnerable |
|
GHSA-gvfx-9m9v-h839
Aliases: CVE-2021-36025 |
Magento is affected by an improper input validation vulnerability while saving a customer's details Magento Commerce versions 2.4.2 (and earlier), … |
Vulnerable |
|
GHSA-5j4w-v87m-8r65
Aliases: CVE-2020-9630 |
Magento business logic error vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-pf6w-3pfw-fxvw
Aliases: CVE-2020-24400 |
Magento SQL Injection vulnerability Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could … |
Vulnerable |
|
GHSA-hmch-9947-82rj
Aliases: CVE-2019-8118 |
Magento 2 Community Edition Weak Cryptography Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to … |
Vulnerable |
|
GHSA-vrq2-w7r7-3fp2
Aliases: CVE-2021-36037 |
Magento is affected by an improper authorization vulnerability Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and … |
Vulnerable |
|
GHSA-8pfq-g48p-x7w8
Aliases: CVE-2021-21022 |
Magento Insecure Direct Object Reference (IDOR) in the product module Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 … |
Vulnerable |
|
GHSA-vrp3-wc28-qg2h
Aliases: CVE-2020-9579 |
Magento Security mitigation bypass vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-p9vf-4jx2-5hpp
Aliases: CVE-2019-8112 |
Magento 2 Community Edition Security Bypass A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … | There are no reported fixed by versions. |
|
GHSA-crv7-r357-gw3w
Aliases: CVE-2019-8114 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, … |
Vulnerable |
|
GHSA-6cwv-wj7v-73xp
Aliases: CVE-2021-36042 |
Magento executes code via the API File Option Upload Extension Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and … |
Vulnerable |
|
GHSA-p746-qw73-qmmx
Aliases: CVE-2021-36033 |
Magento XML Injection vulnerability in the Widgets Module Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and … |
Vulnerable |
|
GHSA-269w-pqc7-68q9
Aliases: CVE-2021-21014 |
Magento vulnerable to a file upload restriction bypass Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) … |
Vulnerable |
|
GHSA-x5q5-6wvf-2fpq
Aliases: CVE-2019-8124 |
Magento 2 Community Edition Insufficient Logging An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento … |
Vulnerable |
|
GHSA-5v5p-x8c2-mqxp
Aliases: CVE-2019-8122 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 … |
Vulnerable |
|
GHSA-29mr-gr4c-vf9c
Aliases: CVE-2019-8115 |
Magento 2 Community Edition XSS Vulnerability A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … | There are no reported fixed by versions. |
|
GHSA-w7rh-9w5v-rwqj
Aliases: CVE-2020-9591 |
Magento defense-in-depth security mitigation vulnerability Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 … |
Vulnerable |
|
GHSA-h437-qjj9-vmq4
Aliases: CVE-2021-21025 |
Magento XPath Injection Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection … |
Vulnerable |
|
GHSA-2x2q-2xpv-mcf9
Aliases: CVE-2019-8127 |
Magento 2 Community Edition SQLi Vulnerability A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … |
Vulnerable |
|
GHSA-4h3p-63x6-vwg2
Aliases: CVE-2021-21031 |
Magento Insufficient Session Expiration Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate … |
Vulnerable |
|
GHSA-w2p4-2c8c-2g7h
Aliases: CVE-2021-21015 |
Magento OS command injection via the customer attribute save controller Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 … |
Vulnerable |
|
GHSA-5pjj-7fq8-9gpf
Aliases: CVE-2021-36028 |
Magento has an XML Injection vulnerability Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are … |
Vulnerable |
|
GHSA-fr6f-xmfx-rrpq
Aliases: CVE-2020-9689 |
Magento path traversal vulnerability Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation … |
Vulnerable |
|
GHSA-7w95-qwhh-q9p3
Aliases: CVE-2021-36031 |
Magento Path Traversal vulnerability via the `theme[preview_image]` parameter Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and … |
Vulnerable |
|
GHSA-fp5m-4mqh-849p
Aliases: CVE-2019-8123 |
Magento 2 Community Edition Insufficient Logging An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and … |
Vulnerable |
|
GHSA-rj4f-cp4v-hvcv
Aliases: CVE-2021-21024 |
Magento Blind SQL Injection in the Search module Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) … |
Vulnerable |
|
GHSA-cj7w-pm77-hvg6
Aliases: CVE-2022-34253 |
Magento XML Injection vulnerability in the Widgets Module Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and … |
Vulnerable |
|
GHSA-fx9g-g9q6-x3jx
Aliases: CVE-2022-34254 |
Magento Path Traversal vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by … |
Vulnerable |
|
GHSA-r7mm-grf3-5fjv
Aliases: CVE-2022-34256 |
Magento Improper Authorization vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by … |
Vulnerable |
|
GHSA-x95x-f4g9-mm85
Aliases: CVE-2022-34255 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected … |
Vulnerable |
|
GHSA-5m55-g8pv-x8ww
Aliases: CVE-2022-34258 |
Magento stored Cross-Site Scripting (XSS) vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are … |
Vulnerable |
|
GHSA-9wjf-94h3-r4rh
Aliases: CVE-2022-34259 |
Magento Improper Access Control vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected … |
Vulnerable |
|
GHSA-rg7p-wmgj-f374
Aliases: CVE-2022-34257 |
Magento stored Cross-Site Scripting (XSS) vulnerability Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are … |
Vulnerable |
|
GHSA-427g-2r83-3ccm
Aliases: CVE-2019-8126 |
Information disclosure through processing of external XML entities An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, … |
Vulnerable |
|
GHSA-89ch-hqf9-rgp3
Aliases: CVE-2019-8121 |
Using JS libraries with known security vulnerabilities An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 … |
Vulnerable |
|
GHSA-fm68-89m8-4gjj
Aliases: CVE-2019-8233 |
Composer JavaScript injection possible via html comments In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, … |
Vulnerable |
|
GHSA-xv69-f7x5-r4qw
Aliases: CVE-2019-8145 |
Magento Cross-Site Scripting via Attribute Set Name A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, … | There are no reported fixed by versions. |
|
GHSA-62fx-3v4f-mwxm
Aliases: CVE-2019-8133 |
Bypass of sitemp access restrictions A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to … |
Vulnerable |
|
GHSA-3q5x-7mxp-rp6j
Aliases: CVE-2019-8135 |
Remote code execution via vulnerable Symphony dependecy injection A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, … |
Vulnerable |
|
GHSA-4f89-5cwm-rm5g
Aliases: CVE-2024-45134 |
Magento Open Source Information Exposure vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an … |
Vulnerable |
|
GHSA-cg52-68fv-94qq
Aliases: CVE-2024-45118 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-v3v6-jfvw-m576
Aliases: CVE-2024-45130 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-w3p2-pc3h-69wv
Aliases: CVE-2024-45124 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-g9fm-wc6h-pvgj
Aliases: CVE-2024-45119 |
Magento Open Source Server-Side Request Forgery (SSRF) vulnerability Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by … |
Vulnerable |
|
GHSA-w7rg-7wq2-pjrw
Aliases: CVE-2024-45149 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-873m-72g6-853g
Aliases: CVE-2024-45116 |
Magento Open Source Cross-Site Scripting (XSS) vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-2qhq-fw98-h6wg
Aliases: CVE-2024-45121 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-xc5p-773w-m3pm
Aliases: CVE-2024-45131 |
Magento Open Source Improper Authorization vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an … |
Vulnerable |
|
GHSA-m58h-998x-66f3
Aliases: CVE-2024-45129 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-8pxg-gcp4-57ww
Aliases: CVE-2024-45135 |
Magento Open Source Improper Access Control vulnerability Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an … |
Vulnerable |
|
GHSA-qpp7-742q-58j3
Aliases: CVE-2024-45128 |
Magento Open Source Improper Authorization vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an … |
Vulnerable |
|
GHSA-47jp-46c9-25vf
Aliases: CVE-2024-45120 |
Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected … |
Vulnerable |
|
GHSA-3fr3-gcqh-3m2g
Aliases: CVE-2024-45117 |
Magento Open Source Improper Input Validation vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-5f64-ppmg-cvvm
Aliases: CVE-2024-45132 |
Magento Open Source Improper Authorization vulnerability Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-j3mh-wx5f-2vhg
Aliases: CVE-2024-45133 |
Magento Open Source Information Exposure vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an … |
Vulnerable |
|
GHSA-xg36-8c2v-jpxh
Aliases: CVE-2024-45125 |
Magento Open Source Incorrect Authorization vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an … |
Vulnerable |
|
GHSA-46fm-x82m-5f74
Aliases: CVE-2024-45122 |
Magento Open Source Improper Access Control vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by … |
Vulnerable |
|
GHSA-88x2-cq34-5fwc
Aliases: CVE-2024-45123 |
Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected … |
Vulnerable |
|
GHSA-c89g-gq5r-2xw2
Aliases: CVE-2024-45127 |
Magento Open Source stored Cross-Site Scripting (XSS) vulnerability Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected … |
Vulnerable |
|
GHSA-jmqp-r3gg-6jh3
Aliases: CVE-2024-34111 |
Magento Open Source Server-Side Request Forgery (SSRF) vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by … |
Vulnerable |
|
GHSA-wwj3-573j-rvvm
Aliases: CVE-2024-34104 |
Magento Open Source Improper Authorization vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-r7cm-g469-wm4g
Aliases: CVE-2024-34107 |
Magento Open Source Improper Access Control vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an … |
Vulnerable |
|
GHSA-m8cj-3v68-3cxj
Aliases: CVE-2024-34102 |
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, … |
Vulnerable |
|
GHSA-p6h9-gx5g-wg64
Aliases: CVE-2024-34106 |
Magento Open Source Incorrect Authorization vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect … |
Vulnerable |
|
GHSA-5632-wq7m-gfq9
Aliases: CVE-2024-34105 |
Magento Open Source Cross-Site Scripting (XSS) vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a … |
Vulnerable |
|
GHSA-f7q4-9gwv-6774
Aliases: CVE-2024-34103 |
Magento Open Source Improper Authentication vulnerability Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper … |
Vulnerable |
|
GHSA-74w7-cr4v-wf2v
Aliases: CVE-2024-39419 |
Magento Improper Access Control Leads to Privilege escalation Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by … |
Vulnerable |
|
GHSA-6pxh-2557-5cj5
Aliases: CVE-2024-39406 |
Magento Open Source Path Traversal vulnerability Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-4xmj-f664-hv98
Aliases: CVE-2024-39417 |
Magento Improper Authorization leads to Security feature bypass Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-rf4q-m23c-7q8r
Aliases: CVE-2024-39409 |
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected … |
Vulnerable |
|
GHSA-qm77-mqf3-fmhq
Aliases: CVE-2024-39411 |
Magento Improper Authorization leads to security feature bypass Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-gj93-84g5-mcjq
Aliases: CVE-2024-39415 |
Magento Improper Authorization Leading to Security feature bypass Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-4cj6-f32v-6hgx
Aliases: CVE-2024-39408 |
Magento Open Source Cross-Site Request Forgery vulnerability Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by … |
Vulnerable |
|
GHSA-4xgg-rw35-7mv5
Aliases: CVE-2024-39416 |
Magento Improper Authorization leads to Security feature bypass Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-4323-f82v-f6jr
Aliases: CVE-2024-39410 |
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected … |
Vulnerable |
|
GHSA-7472-vw39-g2j3
Aliases: CVE-2024-39412 |
Magento Open Source Improper Authorization vulnerability Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-x6f9-hv9r-fgq4
Aliases: CVE-2024-39414 |
Magento Improper Access Control Leads to Privilege escalation Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an … |
Vulnerable |
|
GHSA-4g27-q2w9-m8m8
Aliases: CVE-2021-36021 |
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature Magento versions 2.4.2 (and earlier), 2.4.2-p1 … |
Vulnerable |
|
GHSA-wqr6-wv6c-p8fx
Aliases: CVE-2021-36036 |
Magento improper access control vulnerability within Magento's Media Gallery Upload workflow Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and … |
Vulnerable |
|
GHSA-8cjg-f53m-8m9q
Aliases: CVE-2021-36023 |
Magento XML Injection vulnerability in the Widgets Update Layout Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 … |
Vulnerable |
|
CVE-2022-34254
|
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of … |
Vulnerable Vulnerable |
|
CVE-2019-8111
Aliases: GHSA-2crc-5vq6-386r |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A remote code execution vulnerability exists in … |
Vulnerable Vulnerable |
|
CVE-2020-3717
|
Path Traversal Magento is vulnerable to a path traversal. Successful exploitation could lead to sensitive information disclosure. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-7935
|
Cross-site Scripting A stored cross-site scripting vulnerability exists in the admin panel of Magento. This could be exploited by an … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-3719
|
SQL Injection Magento is vulnerable to SQL injection. Successful exploitation could lead to sensitive information disclosure. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2022-34253
|
XML Injection (aka Blind XPath Injection) Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are … |
Vulnerable Vulnerable |
|
CVE-2019-7909
|
Cross-site Scripting A stored cross-site scripting vulnerability exists in the admin panel of Magento. This could be exploited by an … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21015
|
OS Command Injection Magento is vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could … |
Vulnerable Vulnerable |
|
CVE-2019-7887
|
Cross-site Scripting A reflected cross-site scripting vulnerability exists in the admin panel of Magento when the feature that adds a … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-24400
|
SQL Injection Magento This vulnerability could be exploited by an authenticated user with permissions to the product listing page to … |
Vulnerable Vulnerable |
|
CVE-2019-8151
|
Server-Side Request Forgery (SSRF) A remote code execution vulnerability exists in Magento. An authenticated user with admin privileges to manipulate … |
Vulnerable Vulnerable |
|
CVE-2020-24404
|
Improper Authorization Magento This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages … |
Vulnerable Vulnerable |
|
CVE-2019-8133
Aliases: GHSA-62fx-3v4f-mwxm |
Bypass of sitemp access restrictions A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to … |
Vulnerable Vulnerable |
|
CVE-2019-8153
|
Cross-site Scripting A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento. Successful exploitation of this vulnerability would result … |
Vulnerable Vulnerable |
|
CVE-2022-42344
|
Improper Input Validation Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an … |
Vulnerable Vulnerable |
|
CVE-2020-9591
|
Information Exposure Magento has a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel. |
Vulnerable Vulnerable |
|
CVE-2022-34259
|
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control … |
Vulnerable Vulnerable |
|
CVE-2019-8150
|
Improper Input Validation A remote code execution vulnerability exists in Magento. An authenticated user with privileges to manipulate layouts and … |
Vulnerable Vulnerable |
|
CVE-2019-8126
Aliases: GHSA-427g-2r83-3ccm |
Improper Restriction of XML External Entity Reference An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … |
Vulnerable Vulnerable |
|
CVE-2020-3718
|
Code Execution Magento has a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-3716
|
Deserialization of Untrusted Data Magento has a deserialization vulnerability. Successful exploitation could lead to arbitrary code execution. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8146
|
Cross-site Scripting A stored cross-site scripting (XSS) vulnerability exists in Magento. An authenticated user can inject arbitrary JavaScript code when … |
Vulnerable Vulnerable |
|
CVE-2019-8158
Aliases: GHSA-8p5c-f836-m4h7 |
XML Injection (aka Blind XPath Injection) An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 … |
Vulnerable Vulnerable |
|
CVE-2020-9692
|
Incorrect Authorization Magento has a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution. |
Vulnerable Vulnerable |
|
CVE-2019-8112
Aliases: GHSA-p9vf-4jx2-5hpp |
Insufficient Verification of Data Authenticity A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to … |
Vulnerable Vulnerable |
|
CVE-2019-7882
|
Cross-site Scripting A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento. An authenticated user with privileges to … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8232
|
Improper Input Validation In Magento an authenticated user with administrative privileges for the import feature can execute arbitrary code through … |
Vulnerable Vulnerable |
|
CVE-2019-8152
|
Cross-site Scripting A stored cross-site scripting (XSS) vulnerability exists in in Magento. An authenticated user with access to the wysiwyg … |
Vulnerable Vulnerable |
|
CVE-2020-24401
Aliases: GHSA-f2g3-3c6q-4478 |
Magento 2 Community Edition Incorrect Authorization Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. … |
Vulnerable |
|
CVE-2020-3715
|
Cross-site Scripting Magento has a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8113
Aliases: GHSA-c4r2-3f9r-rwp8 |
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 … |
Vulnerable Vulnerable |
|
CVE-2020-24403
Aliases: GHSA-39rw-4m66-82gf |
Magento incorrect user permissions vulnerability within the Inventory component Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an … |
Vulnerable Vulnerable |
|
CVE-2022-34258
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and … |
Vulnerable Vulnerable |
|
CVE-2019-8140
|
Unrestricted Upload of File with Dangerous Type An unrestricted file upload vulnerability exists in Magento. An authenticated admin user can … |
Vulnerable Vulnerable |
|
CVE-2021-21019
|
XPath Injection Magento is vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution … |
Vulnerable Vulnerable |
|
CVE-2019-8147
|
Cross-site Scripting A stored cross-site scripting (XSS) vulnerability exists in Magento. An authenticated user can inject arbitrary JavaScript code via … |
Vulnerable Vulnerable |
|
CVE-2019-8233
|
Cross-site Scripting In Magento an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring … |
Vulnerable Vulnerable |
|
CVE-2020-24408
|
Cross-site Scripting This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This … |
Vulnerable |
|
CVE-2019-8156
Aliases: GHSA-775w-gx3f-4j4f |
Server-Side Request Forgery (SSRF) A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … |
Vulnerable Vulnerable |
|
CVE-2022-34255
|
Incorrect Authorization Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper … |
Vulnerable Vulnerable |
|
CVE-2020-24402
Aliases: GHSA-hvf5-4jr9-fghh |
Magento incorrect permissions vulnerability in the Integrations component Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect … |
Vulnerable Vulnerable |
|
CVE-2019-8110
Aliases: GHSA-gfcq-wh3g-c6h4 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A remote code execution vulnerability exists in … |
Vulnerable Vulnerable |
|
CVE-2019-8137
Aliases: GHSA-jrjx-8gmw-jj2q |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A remote code execution vulnerability exists in … |
Vulnerable Vulnerable |
|
CVE-2022-34256
|
Incorrect Authorization Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper … |
Vulnerable Vulnerable |
|
CVE-2021-21024
|
Magento is vulnerable to SQL Injection. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. … |
Vulnerable Vulnerable |
|
CVE-2019-8145
|
Cross-site Scripting A stored cross-site scripting (XSS) vulnerability exists in Magento. An authenticated user can inject arbitrary JavaScript code into … |
Vulnerable Vulnerable |
|
CVE-2019-8107
Aliases: GHSA-2cg3-w597-rjfv |
Magento 2 Community Edition Arbitrary File Deletion An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento … |
Vulnerable Vulnerable |
|
CVE-2019-7945
Aliases: GHSA-c45w-p293-7cv6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-cite scripting vulnerability exists in Magento Open Source … |
Vulnerable Vulnerable |
|
CVE-2019-7897
|
Cross-site Scripting A stored cross-site scripting vulnerability exists in the admin panel of Magento. This could be exploited by an … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-15151
Aliases: GHSA-crf2-xm6x-46p6 |
Information Exposure Through Discrepancy Magento allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack … |
Vulnerable |
|
CVE-2020-24407
Aliases: GHSA-7pxg-6p87-8c9v |
Magento 2 Community Edition RCE via Unsafe File Upload Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an … |
Vulnerable |
|
CVE-2019-8154
|
Improper Input Validation A remote code execution vulnerability exists in Magento. An authenticated user with privileges to modify product catalogs … |
Vulnerable Vulnerable |
|
CVE-2019-8135
Aliases: GHSA-3q5x-7mxp-rp6j |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') A remote code execution vulnerability exists in … |
Vulnerable Vulnerable |
|
CVE-2019-7934
|
Cross-site Scripting A stored cross-site scripting vulnerability exists in the admin panel of Magento. This could be exploited by an … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8136
Aliases: GHSA-xgcp-59g2-wm8g |
Magento 2 Community Edition Insecure Component An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior … |
Vulnerable Vulnerable |
|
CVE-2022-34257
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and … |
Vulnerable Vulnerable |
|
CVE-2021-28563
|
Improper Authorization An authorization flaw was found in Magento. Successful exploitation could lead to unauthorized modification of customer data by … |
Vulnerable Vulnerable |
|
CVE-2020-24406
|
Path Traversal When in maintenance mode, Magento This information could be helpful to attackers if they are able to identify … |
Vulnerable Vulnerable |
|
CVE-2020-9579
|
Code Injection Magento has a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution. |
Vulnerable Vulnerable |
|
CVE-2019-8144
|
Improper Input Validation A remote code execution vulnerability exists in Magento. An unauthenticated user can insert a malicious payload through … |
Vulnerable |
|
CVE-2020-24405
|
Improper Authorization Magento This vulnerability could be abused by authenticated users to modify inventory stock data without authorization. |
Vulnerable Vulnerable |
|
CVE-2019-8127
Aliases: GHSA-2x2q-2xpv-mcf9 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') A SQL injection vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable |
|
CVE-2021-21029
|
Cross-site Scripting Magento is vulnerable to Cross-Site Scripting in the admin console. Successful exploitation could lead to arbitrary JavaScript execution … |
Vulnerable Vulnerable |
|
CVE-2019-7139
|
SQL Injection An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-28566
|
Information Exposure Magento is vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. … |
Vulnerable |
|
CVE-2020-9690
|
Information Exposure Through Discrepancy Magento has an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass. |
Vulnerable Vulnerable |
|
CVE-2019-8129
Aliases: GHSA-wg25-j79r-v5wp |
Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior … |
Vulnerable Vulnerable |
|
CVE-2020-3758
|
Cross-site Scripting Magento has a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. |
Vulnerable Vulnerable Vulnerable |
|
GHSA-8578-mmf4-f327
Aliases: CVE-2019-7873 |
Magento 2 Community Edition Cross-site Scripting Vulnerability A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento … |
Vulnerable Vulnerable |
|
GHSA-mf6x-7766-5cg8
Aliases: CVE-2019-7936 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-mgfv-4whf-c574
Aliases: CVE-2019-7908 |
Magento Cross-site Scripting in the admin panel A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 … |
Vulnerable Vulnerable |
|
GHSA-pfxv-66r9-4gqw
Aliases: CVE-2019-7872 |
Magento Insufficient authorization check when adding users to company accounts An insecure direct object reference (IDOR) vulnerability exists in Magento … |
Vulnerable Vulnerable |
|
GHSA-2x55-mg9r-24f7
Aliases: CVE-2019-7896 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-274w-2j5w-m2xj
Aliases: CVE-2019-7899 |
Magento 2 Community Edition Information Disclosure Names of disabled downloadable products could be disclosed due to inadequate validation of user … |
Vulnerable Vulnerable |
|
GHSA-r68f-45jg-64m6
Aliases: CVE-2019-7927 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-hpxv-vpfv-7jc9
Aliases: CVE-2019-7854 |
Magento 2 Community Edition IDOR Vulnerability An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento … |
Vulnerable Vulnerable |
|
GHSA-3mxq-v9rw-m6x9
Aliases: CVE-2019-7944 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the product comments field of Magento Open … |
Vulnerable Vulnerable |
|
GHSA-3h69-4frw-g2jm
Aliases: CVE-2019-7930 |
Magento 2 Community Unrestricted File Upload A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-hrg3-4q56-p2q5
Aliases: CVE-2019-7928 |
Magento 2 Community Edition DoS vulnerability A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-hppc-rpfp-r8qw
Aliases: CVE-2019-7913 |
Magento 2 Community Edition SSRF vulnerability A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento … |
Vulnerable Vulnerable |
|
GHSA-c45w-p293-7cv6
Aliases: CVE-2019-7945 |
Magento 2 Community Edition XSS Vulnerability A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and … |
Vulnerable Vulnerable |
|
GHSA-p8gw-x2p7-vc73
Aliases: CVE-2019-7863 |
Magento Stored cross-site scripting in admin panel A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 … |
Vulnerable Vulnerable |
|
GHSA-4j6w-9rf8-hg7r
Aliases: CVE-2019-7139 |
Magento 2 Community Edition SQLi Vulnerability An unauthenticated user can execute SQL statements that allow arbitrary read access to the … |
Vulnerable Vulnerable |
|
GHSA-vvf9-fxhv-4rgj
Aliases: CVE-2019-7942 |
Magento 2 Community Edition RCE A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-ccjm-rgm5-rjjh
Aliases: CVE-2019-7880 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-vqxq-3wqv-r9xp
Aliases: CVE-2019-7898 |
Magento 2 Community Edition Information Disclosure Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, … |
Vulnerable Vulnerable |
|
GHSA-mw5w-cf76-73m8
Aliases: CVE-2019-7895 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-r728-jwf5-f5r5
Aliases: CVE-2019-7939 |
Magento Reflected cross-site scripting on customer cart page A reflected cross-site scripting vulnerability exists on the customer cart checkout page … |
Vulnerable Vulnerable |
|
GHSA-prw8-gqwp-f7fh
Aliases: CVE-2019-7915 |
Magento 2 Community Edition DoS vulnerability A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to … |
Vulnerable Vulnerable |
|
GHSA-jhvh-mjfg-5m99
Aliases: CVE-2019-7903 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-9f4p-3jgf-98f5
Aliases: CVE-2019-7869 |
Magento Stored Cross-site Scripting vulnerability in the admin panel A stored cross-site scripting vulnerability exists in the admin panel of … |
Vulnerable Vulnerable |
|
GHSA-f6ww-vqw2-xp3v
Aliases: CVE-2019-7857 |
Magento Cross-Site Request Forgery (CSRF) A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to … |
Vulnerable Vulnerable |
|
GHSA-mhvf-j94g-3qp7
Aliases: CVE-2019-7851 |
Magento 2 Community Edition CSRF vulnerability A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-wmrg-w9vg-7jqx
Aliases: CVE-2019-7865 |
Magento 2 Community Edition CSRF Vulnerability A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento … |
Vulnerable Vulnerable |
|
GHSA-v5m6-2m78-4vr2
Aliases: CVE-2019-7877 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-94fc-rxhv-vvf8
Aliases: CVE-2019-7937 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-969v-mwp3-4mr3
Aliases: CVE-2019-7932 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and … |
Vulnerable Vulnerable |
|
GHSA-h522-94xp-2xr6
Aliases: CVE-2019-7929 |
Magento 2 Community Edition Information Disclosure An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-525g-rvh4-v5c9
Aliases: CVE-2019-7926 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-9pgc-rvp9-rqv3
Aliases: CVE-2019-7888 |
Magento 2 Community Edition Information Disclosure An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-7xqv-jgv6-x2h8
Aliases: CVE-2019-7881 |
Magento 2 Community Edition XSS Vulnerability A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-g4jh-vxqm-6fff
Aliases: CVE-2019-7868 |
Magento Cross-site Scripting in the admin panel A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 … |
Vulnerable Vulnerable |
|
GHSA-ff7r-7rrm-wx6w
Aliases: CVE-2019-7882 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source … |
Vulnerable Vulnerable |
|
GHSA-j837-vm6w-6qcv
Aliases: CVE-2019-7861 |
Magento 2 Community Edition Unsafe File Upload Insufficient server-side validation of user input could allow an attacker to bypass file … |
Vulnerable Vulnerable |
|
GHSA-c33v-23rx-7qqc
Aliases: CVE-2019-7864 |
Magento 2 Community Edition IDOR Vulnerability An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento … |
Vulnerable Vulnerable |
|
GHSA-v797-hfv8-v2xm
Aliases: CVE-2019-7849 |
Magento 2 Community Edition Session Fixation Check A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd … |
Vulnerable Vulnerable |
|
GHSA-rj8f-g5gm-jw5c
Aliases: CVE-2019-7887 |
Magento 2 Community Edition Cross-site Scripting Vulnerability A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open … |
Vulnerable Vulnerable |
|
GHSA-8v9h-m7pj-hx7c
Aliases: CVE-2019-7860 |
Magento 2 Community Edition Weak PRNG A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in … |
Vulnerable Vulnerable |
|
GHSA-mp9r-rh95-f8f8
Aliases: CVE-2019-7885 |
Magento 2 Community Edition RCE Vulnerability Insufficient input validation in the config builder of the Elastic search module could lead … |
Vulnerable Vulnerable |
|
GHSA-qmwh-rh2g-3682
Aliases: CVE-2019-7875 |
Magento 2 Community Edition Cross-site Scripting Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento Open … |
Vulnerable Vulnerable |
|
GHSA-3pgc-7jf3-5x5g
Aliases: CVE-2019-7890 |
Magento 2 Community Edition IDOR Vulnerability An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of … |
Vulnerable Vulnerable |
|
GHSA-m3v2-r236-5xgq
Aliases: CVE-2019-7862 |
Magento 2 Community Edition XSS Vulnerability A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the … |
Vulnerable Vulnerable |
|
GHSA-5hcx-vg88-hgpm
Aliases: CVE-2019-7904 |
Magento 2 Community Edition Insufficient Access Controls Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento … |
Vulnerable Vulnerable |
|
GHSA-33cj-w75f-49m2
Aliases: CVE-2019-7911 |
Magento 2 Community Edition Server-Side Request Forgery vulnerability A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior … |
Vulnerable Vulnerable |
|
GHSA-7h8v-f2g9-39fx
Aliases: CVE-2019-7858 |
Magento 2 Community Edition Cryptographic Flaw A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 … |
Vulnerable Vulnerable |
|
GHSA-jxp3-mmw7-8285
Aliases: CVE-2019-7897 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source … |
Vulnerable Vulnerable |
|
GHSA-xcgp-c6hp-cj4r
Aliases: CVE-2019-7852 |
Magento 2 Community Edition Path Disclosure A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-mjgf-xmrr-6gvx
Aliases: CVE-2019-7853 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-3ccx-7588-r6c6
Aliases: CVE-2019-7866 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-2fhr-f6q6-c4p2
Aliases: CVE-2019-7950 |
Magento 2 Community Edition Access Control Bypass An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento … |
Vulnerable Vulnerable |
|
GHSA-hxmp-jcqj-83hm
Aliases: CVE-2019-7889 |
Magento 2 Community Edition Injection Vulnerability An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce … |
Vulnerable Vulnerable |
|
GHSA-w3r8-fxv5-58pp
Aliases: CVE-2019-7892 |
Magento 2 Community Edition RCE Vulnerability via SSRF A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, … |
Vulnerable Vulnerable |
|
GHSA-5j25-5hjr-w7m2
Aliases: CVE-2019-7951 |
Magento 2 Community Edition Information Leak An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-w392-68rg-pgg4
Aliases: CVE-2019-7947 |
Magento 2 Community Edition CSRF vulnerability A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open … |
Vulnerable Vulnerable |
|
GHSA-77mv-p94f-qcq4
Aliases: CVE-2019-7934 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source … |
Vulnerable Vulnerable |
|
GHSA-2w26-gmqm-mc5p
Aliases: CVE-2019-7855 |
Magento 2 Community Cryptographic Flaw A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento … |
Vulnerable Vulnerable |
|
GHSA-c2gg-rrhc-fvvg
Aliases: CVE-2019-7886 |
Magento 2 Community Edition Cryptographic Flaw A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to … |
Vulnerable Vulnerable |
|
GHSA-6qh6-v99h-vh4c
Aliases: CVE-2019-7876 |
Magento 2 Community Edition RCE Vulnerability A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
GHSA-5c4g-p858-498x
Aliases: CVE-2019-7935 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source … |
Vulnerable Vulnerable |
|
GHSA-hqhf-8jgc-h5hx
Aliases: CVE-2019-7859 |
Magento 2 Community Edition Path Traversal Vulnerability A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to … |
Vulnerable Vulnerable |
|
GHSA-mgfr-44wv-hqv6
Aliases: CVE-2019-7938 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source … |
Vulnerable Vulnerable |
|
GHSA-hvcp-jvx5-4pmp
Aliases: CVE-2019-7923 |
Magento 2 Community Edition SSRF vulnerability A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento … |
Vulnerable Vulnerable |
|
GHSA-gg96-8w9x-7rx9
Aliases: CVE-2019-7921 |
Magento 2 Community Edition Cross-site Scripting Vulnerability A stored cross-site scripting vulnerability exists in the product catalog form of Magento … |
Vulnerable Vulnerable |
|
GHSA-vx2g-f45p-j674
Aliases: CVE-2019-7867 |
Magento 2 Community Edition XSS Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior … |
Vulnerable Vulnerable |
|
GHSA-pw2f-m22m-p75c
Aliases: CVE-2019-7909 |
Magento 2 Community Edition Cross-site Scripting Vulnerability A stored cross-site scripting vulnerability exists in the admin panel of Magento Open … |
Vulnerable Vulnerable |
|
GHSA-f8h9-7rpq-7qcc
Aliases: CVE-2019-7912 |
Magento Filter extension bypass via crafted store configuration keys A file upload filter bypass exists in Magento 2.1 prior to … |
Vulnerable Vulnerable |
|
GHSA-7g5j-q8qj-8984
Aliases: CVE-2019-7925 |
Magento Insecure Direct Object Reference (IDOR) vulnerability An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to … |
Vulnerable Vulnerable |
|
GHSA-v527-6h5r-cfg8
Aliases: CVE-2019-7871 |
Magento 2 Community Edition Unsafe File Upload A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-8v75-8jj8-77gf
Aliases: CVE-2019-7874 |
Magento 2 Community Edition XSS Vulnerability A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 … |
Vulnerable Vulnerable |
|
CVE-2019-8117
Aliases: GHSA-v99w-jxr4-w6mc |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8092
Aliases: GHSA-56hf-w8gm-448q |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8132
Aliases: GHSA-g378-6fg4-gx3v |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8138
Aliases: GHSA-85xw-3hp5-6fmc |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8148
Aliases: GHSA-86pc-6mm8-542r |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 … |
Vulnerable Vulnerable |
|
CVE-2019-8131
Aliases: GHSA-vx7m-v8v2-fhwm |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8142
Aliases: GHSA-298q-wv2h-v5vw |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8139
Aliases: GHSA-gjjm-4x3g-3h33 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8159
Aliases: GHSA-47h6-hfpv-7phj |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A remote code execution vulnerability exists in … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8109
Aliases: GHSA-x72m-p4qc-p7rv |
Cross-Site Request Forgery (CSRF) A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-8115
Aliases: GHSA-29mr-gr4c-vf9c |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-wg25-j79r-v5wp
Aliases: CVE-2019-8129 |
Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior … |
Vulnerable Vulnerable |
|
GHSA-rr59-pjwj-6grj
Aliases: CVE-2020-3719 |
Magento sql injection vulnerability Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have … |
Vulnerable Vulnerable |
|
GHSA-mgg3-v948-2vgr
Aliases: CVE-2020-3715 |
Magento stored cross-site scripting vulnerability Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier … |
Vulnerable Vulnerable |
|
GHSA-p5q3-xg47-653m
Aliases: CVE-2020-3758 |
Magento stored cross-site scripting vulnerability Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier … |
Vulnerable Vulnerable |
|
GHSA-x9p7-vgp2-9pq2
Aliases: CVE-2020-3718 |
Magento security bypass vulnerability Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have … |
Vulnerable Vulnerable |