Adobe Magento Commerce
85 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-38208 | ≤ 2.4.4-p4 | Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | CRITICAL 9.1 | 2.5 % | ||
| CVE-2023-38209 | ≤ 2.4.4-p4 | Adobe Commerce Incorrect Authorization Security feature bypass | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-29297 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Admin-to-admin stored XSS via cache poisoning | CRITICAL 9.1 | 1.4 % | ||
| CVE-2023-29296 | unspecified – 2.4.5-p1 ; unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; … | [Cloud] Customer suspects IDOR vulnerability | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-29295 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Insecure Direct Object Reference (IDOR) in Create Quote Function | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-29294 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Bypass Purchase Order Approval using Company User in Adobe Commerce B2B | MEDIUM 4.3 | 0.7 % | ||
| CVE-2023-29292 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Server Side Request Forgery (SSRF) in FedEx carrier integration configuration | MEDIUM 4.9 | 1.0 % | ||
| CVE-2023-29291 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Server Side Request Forgery (SSRF) in USPS carrier integration configuration | MEDIUM 4.9 | 1.1 % | ||
| CVE-2023-29290 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Adobe Commerce Guest Cart Shipping Address Overwrite IDOR | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-29289 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Adobe Commerce XML Injection Security feature bypass | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-29287 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Adobe Commerce Information Exposure Security feature bypass | MEDIUM 5.3 | 0.7 % | ||
| CVE-2023-22248 | unspecified – 2.4.6 ; unspecified – 2.4.5-p2 ; unspecified – 2.4.4-p3 ; … | Adobe Commerce Incorrect Authorization Security feature bypass | HIGH 7.5 | 1.0 % | ||
| CVE-2023-22251 | unspecified – 2.4.5-p1 ; unspecified – 2.4.4-p2 ; unspecified – None | Adobe Commerce Incorrect Authorization Security feature bypass | MEDIUM 4.3 | 0.6 % | ||
| CVE-2023-22250 | unspecified – 2.4.5-p1 ; unspecified – 2.4.4-p2 ; unspecified – None | Adobe Commerce Improper Access Control Security feature bypass | MEDIUM 5.3 | 1.0 % | ||
| CVE-2023-22249 | unspecified – 2.4.5-p1 ; unspecified – 2.4.4-p2 ; unspecified – None | Adobe Commerce Stored XSS Arbitrary code execution | MEDIUM 4.8 | 58 % | ||
| CVE-2023-22247 | unspecified – 2.4.5-p1 ; unspecified – 2.4.4-p2 ; unspecified – None | Adobe Commerce XML Injection Arbitrary file system read | HIGH 7.5 | 0.9 % | ||
| CVE-2022-35689 | unspecified – 2.4.5 ; unspecified – 2.4.4-p1 ; unspecified – None | Adobe Commerce Improper Access Control Security feature bypass | MEDIUM 5.3 | 1.4 % | ||
| CVE-2022-35698 | unspecified – 2.4.5 ; unspecified – 2.4.4-p1 ; unspecified – None | Adobe Commerce Stored XSS Arbitrary code execution | CRITICAL 10.0 | 15 % | ||
| CVE-2022-35692 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Improper Access Control Security feature bypass | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-34259 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Improper Access Control Security feature bypass | MEDIUM 5.3 | 1.6 % | ||
| CVE-2022-34257 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Stored XSS Arbitrary code execution | MEDIUM 6.1 | 1.0 % | ||
| CVE-2022-34253 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce XML Injection Arbitrary code execution | CRITICAL 9.1 | 5.0 % | ||
| CVE-2022-34255 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Improper Access Control Privilege escalation | HIGH 8.8 | 2.3 % | ||
| CVE-2022-34254 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution | HIGH 8.8 | 2.3 % | ||
| CVE-2022-34256 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Improper Authorization Privilege escalation | CRITICAL 9.8 | 2.1 % | ||
| CVE-2022-34258 | unspecified – 2.4.4 ; unspecified – 2.3.7-p3 ; unspecified – 2.4.3-p2 ; … | Adobe Commerce Stored XSS Arbitrary code execution | MEDIUM 4.8 | 69 % | ||
| CVE-2022-24086 | unspecified – 2.4.3-p1 ; unspecified – 2.3.7-p2 ; unspecified – None | Adobe Commerce checkout improper input validation leads to remote code execution | CRITICAL 9.8 | 99 % | KEV | |
| CVE-2021-39864 | unspecified – 2.4.3 ; unspecified – 2.4.2-p2 ; unspecified – 2.3.7-p1 ; … | Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition | MEDIUM 6.5 | 1.6 % | ||
| CVE-2021-28567 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission | MEDIUM 6.5 | 0.8 % | ||
| CVE-2021-28566 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce information disclosure during upload action leveraging a specially crafted file | LOW 3.7 | 1.4 % | ||
| CVE-2021-36044 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service | HIGH 7.5 | 2.0 % | ||
| CVE-2021-36027 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Stored Cross-site Scripting Vulnerability | MEDIUM 6.5 | 1.4 % | ||
| CVE-2021-36043 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution | HIGH 8.0 | 1.9 % | ||
| CVE-2021-36042 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.5 % | ||
| CVE-2021-36030 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation | HIGH 7.5 | 2.3 % | ||
| CVE-2021-36041 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Input Validation Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.4 % | ||
| CVE-2021-36040 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Input Validation Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.9 % | ||
| CVE-2021-36025 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.8 % | ||
| CVE-2021-36020 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution | CRITICAL 9.8 | 2.7 % | ||
| CVE-2021-36035 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.8 % | ||
| CVE-2021-36024 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Neutralization of Special Elements Used In A Command | CRITICAL 9.1 | 2.9 % | ||
| CVE-2021-36031 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution | HIGH 7.2 | 3.1 % | ||
| CVE-2021-36039 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure | MEDIUM 6.5 | 1.7 % | ||
| CVE-2021-36029 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.5 % | ||
| CVE-2021-36026 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Stored Cross-site Scripting Vulnerability | MEDIUM 6.5 | 1.7 % | ||
| CVE-2021-36032 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation | HIGH 8.8 | 2.2 % | ||
| CVE-2021-36038 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure | MEDIUM 6.5 | 1.8 % | ||
| CVE-2021-36028 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.9 % | ||
| CVE-2021-36034 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Input Validation Could Lead To Remote Code Execution | CRITICAL 9.1 | 2.4 % | ||
| CVE-2021-36022 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution | CRITICAL 9.1 | 3.4 % | ||
| CVE-2021-36033 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution | CRITICAL 9.1 | 3.1 % | ||
| CVE-2021-36037 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure | MEDIUM 6.5 | 1.8 % | ||
| CVE-2021-36012 | unspecified – 2.4.2 ; unspecified – 2.4.2-p1 ; unspecified – 2.3.7 ; … | Magento Commerce Gift Card Business Logic Error | MEDIUM 6.5 | 2.0 % | ||
| CVE-2021-28584 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce path traversal vulnerability in child theme store creation | HIGH 7.2 | 1.8 % | ||
| CVE-2021-28585 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce improper input validation in customer customer webapi | MEDIUM 5.3 | 1.6 % | ||
| CVE-2021-28583 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce insecure storage of sensitive documentation | HIGH 7.5 | 1.9 % | ||
| CVE-2021-28563 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce improper Authorization via the 'Create Customer' endpoint | MEDIUM 6.5 | 1.4 % | ||
| CVE-2021-28556 | unspecified – 2.4.2 ; unspecified – 2.3.6-p1 ; unspecified – 2.4.1-p1 ; … | Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution | MEDIUM 6.9 | 1.4 % | ||
| CVE-2021-21064 | unspecified – 1.1.4 ; unspecified – None | Magento UPWARD-php Path traversal vulnerability via UPWARD Connector | MEDIUM 4.9 | 8.5 % | ||
| CVE-2021-21014 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution | CRITICAL 9.1 | 4.2 % | ||
| CVE-2021-21016 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 | Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution | CRITICAL 9.1 | 4.9 % | ||
| CVE-2021-21032 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access | MEDIUM 5.6 | 1.6 % | ||
| CVE-2021-21029 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution | MEDIUM 4.8 | 85 % | ||
| CVE-2021-21025 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce XML Injection Could Lead To Arbitrary Code Execution | CRITICAL 9.1 | 3.3 % | ||
| CVE-2021-21018 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution | CRITICAL 9.1 | 4.0 % | ||
| CVE-2021-21030 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution | HIGH 8.1 | 5.6 % | ||
| CVE-2021-21027 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification | MEDIUM 4.3 | 1.7 % | ||
| CVE-2021-21026 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Incorrect permissions Could Lead To Unauthorized Access | MEDIUM 5.3 | 1.8 % | ||
| CVE-2021-21024 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access | CRITICAL 9.1 | 2.8 % | ||
| CVE-2021-21023 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution | MEDIUM 4.8 | 1.6 % | ||
| CVE-2021-21022 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Incorrect permissions Could Lead To Unauthorized Access | MEDIUM 5.3 | 2.2 % | ||
| CVE-2021-21020 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Improper Access Control Vulnerability | MEDIUM 5.3 | 2.4 % | ||
| CVE-2021-21019 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce XML Injection Could Lead To Remote Code Execution | CRITICAL 9.1 | 3.6 % | ||
| CVE-2021-21015 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution | HIGH 8.0 | 2.9 % | ||
| CVE-2021-21013 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Insecure Direct Object Reference Could Lead To Information Disclosure | HIGH 8.1 | 3.2 % | ||
| CVE-2021-21012 | unspecified – 2.4.1 ; unspecified – 2.4.0-p1 ; unspecified – 2.3.6 ; … | Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure | MEDIUM 5.3 | 4.0 % | ||
| CVE-2020-24404 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API | LOW 2.7 | 1.9 % | ||
| CVE-2020-24407 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Arbitrary code execution via file import functionality | CRITICAL 9.1 | 5.3 % | ||
| CVE-2020-24406 | unspecified – 2.4.0 ; unspecified – 2.3.4 ; unspecified – None | Document root path disclosure on Maintenance page | LOW 3.7 | 2.1 % | ||
| CVE-2020-24405 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data | MEDIUM 4.3 | 1.5 % | ||
| CVE-2020-24403 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Incorrect permissions could lead to unauthorized modification of inventory source data via REST API | LOW 2.7 | 1.6 % | ||
| CVE-2020-24401 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Incorrect permissions following the deletion of a user role or deactivation of a user | MEDIUM 6.5 | 2.3 % | ||
| CVE-2020-24402 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API | MEDIUM 4.9 | 1.7 % | ||
| CVE-2020-24400 | unspecified – 2.4.0 ; unspecified – 2.3.5 ; unspecified – None | SQL injection allows arbitrary read from database | HIGH 7.1 | 2.3 % | ||
| CVE-2020-24408 | unspecified – 2.4.0 ; unspecified – 2.3.5p1 ; unspecified – None | Stored XSS in customer address upload feature | MEDIUM 6.1 | 1.7 % |