MA
Product
Magento
221
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 69Medium 112Low 4
Watch
Add Magento to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-8092 | 5.4 | Nov 5 | A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-7945 | 5.4 | Aug 2 | A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7944 | 5.4 | Aug 2 | A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7921 | 5.4 | Aug 2 | A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7882 | 5.4 | Aug 2 | A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7881 | 5.4 | Aug 2 | A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2022-34259 | 5.3 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-28585 | 5.3 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer… Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.3.6; 2.3.6; +6 more |
| CVE-2021-21026 | 5.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2021-21022 | 5.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2021-21020 | 5.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2020-3717 | 5.3 | Jan 29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability Affected: through 1.9.4.3; through 1.14.4.3; 2.2.0 through 2.2.10; 2.2.0 through 2.2.10; 2.3.0 through 2.3.3; 2.3.0 through 2.3.3 |
| CVE-2019-8123 | 5.3 | Nov 5 | An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior… Affected: before 1.9.3.4; before 1.14.4.3; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 through 2.3.2; 2.3.0 through 2.3.2 |
| CVE-2019-8118 | 5.3 | Nov 5 | Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts Affected: 2.1.0 before 2.1.19; 2.1.0 before 2.1.19; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; +2 more |
| CVE-2019-8113 | 5.3 | Nov 5 | Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer… Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-7899 | 5.3 | Aug 2 | Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7898 | 5.3 | Aug 2 | Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7864 | 5.3 | Aug 2 | An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7855 | 5.3 | Aug 2 | A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7852 | 5.3 | Aug 2 | A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2016-2212 | 5.3 | Apr 15 | The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento… Affected: through 1.9.2.2; through 1.14.2.2 |
| CVE-2020-24402 | 4.9 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5; +2 more |
| CVE-2019-8140 | 4.9 | Nov 6 | An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8126 | 4.9 | Nov 5 | An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8124 | 4.9 | Nov 5 | An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 Affected: 2.1.0 before 2.1.19; 2.1.0 before 2.1.19; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; +2 more |
| CVE-2019-7929 | 4.9 | Aug 2 | An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7925 | 4.9 | Aug 2 | An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2022-34258 | 4.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-28556 | 4.8 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies Affected: before 2.3.7; before 2.3.7; 2.4.0 through 2.4.2; 2.4.0 through 2.4.2 |
| CVE-2021-21029 | 4.8 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2021-21023 | 4.8 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2019-8228 | 4.8 | Nov 6 | in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional… Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3 |
| CVE-2019-8227 | 4.8 | Nov 6 | In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export… Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3 |
| CVE-2019-8148 | 4.8 | Nov 6 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8115 | 4.8 | Nov 5 | A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 through 2.3.2; 2.3.0 through 2.3.2 |
| CVE-2019-7940 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7938 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7937 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7936 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7935 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7934 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7927 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7926 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7909 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7908 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7897 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7887 | 4.8 | Aug 2 | A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7880 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7875 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18,… Affected: before 1.9.4.2; before 1.14.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7869 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |