MA
Product
Magento
221
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 31High 69Medium 112Low 4
Watch
Add Magento to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-42344 | 8.8 | Oct 20 | [CVE-2021-36032] Magento IDOR Leads to Account Takeover Affected: before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2022-34255 | 8.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2022-34254 | 8.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory… Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2015-6497 | 8.8 | Jan 15 | The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used… Affected: before 1.9.2.1; before 1.14.2.1 |
| CVE-2019-8159 | 8.8 | Nov 6 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8154 | 8.8 | Nov 6 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8150 | 8.8 | Nov 6 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8137 | 8.8 | Nov 6 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8134 | 8.8 | Nov 6 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8130 | 8.8 | Nov 6 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8127 | 8.8 | Nov 5 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8122 | 8.8 | Nov 5 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 Affected: 2.1.0 before 2.1.19; 2.1.0 before 2.1.19; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 through 2.3.2; 2.3.0 through 2.3.2 |
| CVE-2019-8111 | 8.8 | Nov 5 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8110 | 8.8 | Nov 5 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8093 | 8.8 | Nov 5 | An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-7885 | 8.8 | Aug 2 | Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9,… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7876 | 8.8 | Aug 2 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7871 | 8.8 | Aug 2 | A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7865 | 8.8 | Aug 2 | A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2021-21030 | 8.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2021-21015 | 8.0 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.4.0; 2.4.0; +4 more |
| CVE-2020-15151 | 8.0 | Aug 20 | OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site… Affected: through 2.3.5; through 2.3.5 |
| CVE-2019-8109 | 8.0 | Nov 5 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2020-9591 | 7.5 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability Affected: through 1.9.4.4; through 1.14.4.4; 2.2.0 through 2.2.11; 2.2.0 through 2.2.11; 2.3.0 through 2.3.4; 2.3.0 through 2.3.4 |
| CVE-2020-9587 | 7.5 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability Affected: through 1.9.4.4; through 1.14.4.4; 2.2.0 through 2.2.11; 2.2.0 through 2.2.11; 2.3.0 through 2.3.4; 2.3.0 through 2.3.4 |
| CVE-2020-3719 | 7.5 | Jan 29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability Affected: through 1.9.4.3; through 1.14.4.3; 2.2.0 through 2.2.10; 2.2.0 through 2.2.10; 2.3.0 through 2.3.3; 2.3.0 through 2.3.3 |
| CVE-2019-8155 | 7.5 | Nov 6 | Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3 |
| CVE-2019-8116 | 7.5 | Nov 5 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8112 | 7.5 | Nov 5 | A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-7951 | 7.5 | Aug 2 | An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7950 | 7.5 | Aug 2 | An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7928 | 7.5 | Aug 2 | A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7915 | 7.5 | Aug 2 | A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7886 | 7.5 | Aug 2 | A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7861 | 7.5 | Aug 2 | Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7860 | 7.5 | Aug 2 | A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7859 | 7.5 | Aug 2 | A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7858 | 7.5 | Aug 2 | A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7854 | 7.5 | Aug 2 | An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7849 | 7.5 | Aug 2 | A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules Affected: before 1.14.4.2; 1.0.0 before 1.9.4.2; 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2019-7890 | 7.3 | Aug 2 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to… Affected: 2.1.0 before 2.1.18; 2.2.0 before 2.2.9; 2.3.0 before 2.3.2 |
| CVE-2021-36036 | 7.2 | Sep 6 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload… Affected: before 2.3.7; before 2.3.7; 2.4.0 before 2.4.2; 2.4.0 before 2.4.2; 2.3.7; 2.3.7; +4 more |
| CVE-2021-36023 | 7.2 | Sep 6 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout Affected: before 2.3.7; before 2.3.7; 2.4.0 before 2.4.2; 2.4.0 before 2.4.2; 2.3.7; 2.3.7; +4 more |
| CVE-2021-36021 | 7.2 | Sep 6 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled… Affected: before 2.3.7; before 2.3.7; 2.4.0 before 2.4.2; 2.4.0 before 2.4.2; 2.3.7; 2.3.7; +4 more |
| CVE-2022-34253 | 7.2 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module Affected: 2.3.0 before 2.3.7; 2.4.0 before 2.4.3; 2.3.7; 2.3.7; 2.3.7; 2.3.7; +4 more |
| CVE-2021-28584 | 7.2 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child… Affected: before 2.3.6; before 2.3.6; 2.3.6; 2.3.6; 2.3.6; 2.3.6; +6 more |
| CVE-2020-9588 | 7.2 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability Affected: through 1.9.4.4; through 1.14.4.4; 2.2.0 through 2.2.11; 2.2.0 through 2.2.11; 2.3.0 through 2.3.4; 2.3.0 through 2.3.4 |
| CVE-2019-8156 | 7.2 | Nov 6 | A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Affected: 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; 2.3.2; 2.3.2 |
| CVE-2019-8231 | 7.2 | Nov 6 | In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom… Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3 |
| CVE-2019-8230 | 7.2 | Nov 6 | In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a… Affected: 1.5.0.0 before 1.9.4.3; 1.9.0.0 before 1.14.4.3 |