MA
Product
Magento
221
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 69Medium 112Low 4
Watch
Add Magento to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-7868 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7867 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7866 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7863 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7862 | 4.8 | Aug 2 | A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9,… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7853 | 4.8 | Aug 2 | A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2021-21027 | 4.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2020-24405 | 4.3 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5; +2 more |
| CVE-2019-7873 | 4.3 | Aug 2 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7857 | 4.3 | Aug 2 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2021-28583 | 4.2 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename… Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.3.6; 2.3.6; +6 more |
| CVE-2020-9690 | 4.2 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5 |
| CVE-2020-24406 | 3.7 | Nov 9 | When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during… Affected: through 2.3.4; through 2.3.4; 2.4.0; 2.4.0 |
| CVE-2021-28566 | 2.7 | Sep 8 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png… Affected: through 2.4.2; through 2.4.2 |
| CVE-2020-24404 | 2.7 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5; +2 more |
| CVE-2020-24403 | 2.7 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component Affected: before 2.3.5; before 2.3.5; 2.3.5; 2.3.5; 2.3.5; 2.3.5; +2 more |
| CVE-2015-3458 | – | Apr 29 | The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream… Affected: 1.9.1.0; 1.14.1.0 |
| CVE-2015-3457 | – | Apr 29 | Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter Affected: 1.9.1.0; 1.14.1.0 |
| CVE-2015-1399 | – | Apr 29 | PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE)… Affected: 1.9.1.0; 1.14.1.0 |
| CVE-2015-1398 | – | Apr 29 | Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute… Affected: 1.9.1.0; 1.14.1.0 |
| CVE-2015-1397 | – | Apr 29 | SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0… Affected: 1.9.1.0; 1.14.1.0 |