Magento Commerce (Adobe) - vulnerabilities (CVEs)

85 CVEs, 0 in the last 30 days, 13 known versions, newest CVE from 2023-08-09. Vendor: Adobe.

CVEs of Magento Commerce

• CVE-2023-38209 - CVSS 6.5 (medium), 2023-08-09: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability…
• CVE-2023-38208 - CVSS 9.1 (critical), 2023-08-09: Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special…
• CVE-2023-29294 - CVSS 4.3 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that…
• CVE-2023-29297 - CVSS 9.1 (critical), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements…
• CVE-2023-29296 - CVSS 4.3 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that…
• CVE-2023-29295 - CVSS 4.3 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that…
• CVE-2023-29290 - CVSS 5.3 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that…
• CVE-2023-29289 - CVSS 6.5 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker…
• CVE-2023-29292 - CVSS 4.9 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF)…
• CVE-2023-29287 - CVSS 5.3 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that…
• CVE-2023-29291 - CVSS 4.9 (medium), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF)…
• CVE-2023-22248 - CVSS 7.5 (high), 2023-06-15: Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that…
• CVE-2023-22247 - CVSS 7.5 (high), 2023-03-27: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file…
• CVE-2023-22251 - CVSS 4.3 (medium), 2023-03-27: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged…
• CVE-2023-22250 - CVSS 5.3 (medium), 2023-03-27: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a…
• CVE-2023-22249 - CVSS 4.8 (medium), 2023-03-27: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be…
• CVE-2022-35698 - CVSS 10 (critical), 2022-10-14: Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue…
• CVE-2022-35689 - CVSS 5.3 (medium), 2022-10-14: Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a…
• CVE-2022-35692 - CVSS 5.3 (medium), 2022-08-19: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that…
• CVE-2022-34254 - CVSS 8.8 (high), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a…
• CVE-2022-34257 - CVSS 6.1 (medium), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS)…
• CVE-2022-34256 - CVSS 9.8 (critical), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that…
• CVE-2022-34259 - CVSS 5.3 (medium), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that…
• CVE-2022-34255 - CVSS 8.8 (high), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that…
• CVE-2022-34258 - CVSS 4.8 (medium), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS)…
• CVE-2022-34253 - CVSS 9.1 (critical), 2022-08-16: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets…
• CVE-2022-24086 - CVSS 9.8 (critical), 2022-02-16: Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout…
• CVE-2021-39864 - CVSS 6.5 (medium), 2021-10-15: Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF)…
• CVE-2021-28567 - CVSS 6.5 (medium), 2021-09-08: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the…
• CVE-2021-28566 - CVSS 3.7 (low), 2021-09-08: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when…
• CVE-2021-36040 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An…
• CVE-2021-36043 - CVSS 8 (high), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled…
• CVE-2021-36039 - CVSS 6.5 (medium), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via…
• CVE-2021-36042 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in…
• CVE-2021-36041 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An…
• CVE-2021-36044 - CVSS 7.5 (high), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An…
• CVE-2021-36033 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets…
• CVE-2021-36037 - CVSS 6.5 (medium), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization…
• CVE-2021-36022 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets…
• CVE-2021-36026 - CVSS 6.5 (medium), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in…
• CVE-2021-36029 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization…
• CVE-2021-36032 - CVSS 8.8 (high), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An…
• CVE-2021-36035 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An…
• CVE-2021-36020 - CVSS 9.8 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City'…
• CVE-2021-36025 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while…
• CVE-2021-36028 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a…
• CVE-2021-36031 - CVSS 7.2 (high), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the…
• CVE-2021-36034 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An…
• CVE-2021-36038 - CVSS 6.5 (medium), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in…
• CVE-2021-36012 - CVSS 6.5 (medium), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql…
• CVE-2021-36024 - CVSS 9.1 (critical), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements…
• CVE-2021-36027 - CVSS 6.5 (medium), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that…
• CVE-2021-36030 - CVSS 7.5 (high), 2021-09-01: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability…
• CVE-2021-28585 - CVSS 5.3 (medium), 2021-06-28: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New…
• CVE-2021-28584 - CVSS 7.2 (high), 2021-06-28: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store…
• CVE-2021-28583 - CVSS 7.5 (high), 2021-06-28: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability…
• CVE-2021-28563 - CVSS 6.5 (medium), 2021-06-28: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the…
• CVE-2021-28556 - CVSS 6.9 (medium), 2021-06-28: Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on…
• CVE-2021-21064 - CVSS 4.9 (medium), 2021-02-25: Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to…
• CVE-2021-21014 - CVSS 9.1 (critical), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful…
• CVE-2021-21020 - CVSS 5.3 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as…
• CVE-2021-21024 - CVSS 9.1 (critical), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module.…
• CVE-2021-21027 - CVSS 4.3 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the…
• CVE-2021-21032 - CVSS 5.6 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of…
• CVE-2021-21019 - CVSS 9.1 (critical), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful…
• CVE-2021-21023 - CVSS 4.8 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the…
• CVE-2021-21026 - CVSS 5.3 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the…
• CVE-2021-21030 - CVSS 8.1 (high), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer…
• CVE-2021-21018 - CVSS 9.1 (critical), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation…
• CVE-2021-21022 - CVSS 5.3 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the…
• CVE-2021-21025 - CVSS 9.1 (critical), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful…
• CVE-2021-21029 - CVSS 4.8 (medium), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file'…
• CVE-2021-21016 - CVSS 9.1 (critical), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful…
• CVE-2021-21015 - CVSS 8 (high), 2021-02-11: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save…
• CVE-2021-21013 - CVSS 8.1 (high), 2021-01-13: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the…
• CVE-2021-21012 - CVSS 5.3 (medium), 2021-01-13: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the…
• CVE-2020-24401 - CVSS 6.5 (medium), 2020-11-09: Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under…
• CVE-2020-24404 - CVSS 2.7 (low), 2020-11-09: Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability…
• CVE-2020-24407 - CVSS 9.1 (critical), 2020-11-09: Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This…
• CVE-2020-24400 - CVSS 7.1 (high), 2020-11-09: Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This…
• CVE-2020-24403 - CVSS 2.7 (low), 2020-11-09: Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability…
• CVE-2020-24406 - CVSS 3.7 (low), 2020-11-09: When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the…
• CVE-2020-24402 - CVSS 4.9 (medium), 2020-11-09: Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could…
• CVE-2020-24405 - CVSS 4.3 (medium), 2020-11-09: Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could…
• CVE-2020-24408 - CVSS 6.1 (medium), 2020-10-16: Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file…