MA
Product
Magento
221
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 69Medium 112Low 4
Watch
Add Magento to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-8232 | 6.6 | Nov 6 | In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative… Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; +2 more |
| CVE-2021-28567 | 6.5 | Sep 8 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module Affected: through 2.4.2; through 2.4.2 |
| CVE-2021-28563 | 6.5 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint Affected: before 2.3.7; before 2.3.7; 2.4.0 through 2.4.2; 2.4.0 through 2.4.2 |
| CVE-2020-24401 | 6.5 | Nov 9 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5; +2 more |
| CVE-2020-9692 | 6.5 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5 |
| CVE-2020-9689 | 6.5 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5 |
| CVE-2019-8143 | 6.5 | Nov 6 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8133 | 6.5 | Nov 6 | A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8108 | 6.5 | Nov 5 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8107 | 6.5 | Nov 5 | An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8090 | 6.5 | Nov 5 | An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 Affected: 2.1.0 before 2.1.19; 2.1.0 before 2.1.19; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; +2 more |
| CVE-2019-8235 | 6.5 | Oct 30 | An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions Affected: 2.1.0 before 2.1.17; 2.1.0 before 2.1.17; 2.2.0 before 2.2.8; 2.2.0 before 2.2.8; 2.3.0 before 2.3.1; 2.3.0 before 2.3.1 |
| CVE-2019-7947 | 6.5 | Aug 2 | A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7904 | 6.5 | Aug 2 | Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7889 | 6.5 | Aug 2 | An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7888 | 6.5 | Aug 2 | An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7874 | 6.5 | Aug 2 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7872 | 6.5 | Aug 2 | An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7851 | 6.5 | Aug 2 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2018-5301 | 6.5 | Jan 8 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433 Affected: before 2.0.10; 2.1.0 before 2.1.2; before 2.0.10; 2.1.0 before 2.1.2 |
| CVE-2022-34257 | 6.1 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2020-24408 | 6.1 | Oct 16 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component Affected: through 2.3.4; through 2.3.4; 2.3.5; 2.3.5; 2.3.5; 2.3.5; +2 more |
| CVE-2020-9665 | 6.1 | Jul 22 | Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability Affected: through 1.9.4.5; through 1.14.4.5 |
| CVE-2020-9581 | 6.1 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability Affected: through 1.9.4.4; through 1.14.4.4; 2.2.0 through 2.2.11; 2.2.0 through 2.2.11; 2.3.0 through 2.3.4; 2.3.0 through 2.3.4 |
| CVE-2020-9577 | 6.1 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability Affected: through 1.9.4.4; through 1.14.4.4; 2.2.0 through 2.2.11; 2.2.0 through 2.2.11; 2.3.0 through 2.3.4; 2.3.0 through 2.3.4 |
| CVE-2020-3758 | 6.1 | Jan 29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability Affected: through 1.9.4.3; through 1.14.4.3; 2.2.0 through 2.2.10; 2.2.0 through 2.2.10; 2.3.0 through 2.3.3; 2.3.0 through 2.3.3 |
| CVE-2020-3715 | 6.1 | Jan 29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability Affected: through 1.9.4.3; through 1.14.4.3; 2.2.0 through 2.2.10; 2.2.0 through 2.2.10; 2.3.0 through 2.3.3; 2.3.0 through 2.3.3 |
| CVE-2019-8233 | 6.1 | Nov 6 | In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine… Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8153 | 6.1 | Nov 6 | A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-7939 | 6.1 | Aug 2 | A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7877 | 6.1 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2016-10704 | 6.1 | Dec 30 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503 Affected: before 2.0.10; before 2.0.10; 2.1.0 before 2.1.2; 2.1.0 before 2.1.2 |
| CVE-2014-9758 | 6.1 | Sep 20 | Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1 Affected: 1.9.0.1 |
| CVE-2021-21032 | 5.6 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2021-21031 | 5.6 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2020-9584 | 5.4 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability Affected: through 1.9.4.4; through 1.14.4.4; 2.2.0 through 2.2.11; 2.2.0 through 2.2.11; 2.3.0 through 2.3.4; 2.3.0 through 2.3.4 |
| CVE-2019-8157 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8145 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8132 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8152 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; +2 more |
| CVE-2019-8147 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8146 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8142 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8139 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8138 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8131 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8129 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8128 | 5.4 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8120 | 5.4 | Nov 5 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 Affected: 2.1.0 before 2.1.19; 2.1.0 before 2.1.19; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 through 2.3.2; 2.3.0 through 2.3.2 |
| CVE-2019-8117 | 5.4 | Nov 5 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 through 2.3.2; 2.3.0 through 2.3.2 |