MA
Vendor
Magento
225
CVEs
0
On KEV
0
New 30D
Products
MA9.8
Magento
Magento
221 CVEs0 on KEV0 new
AN9.8
Advanced Newsletter
Magento
1 CVEs0 on KEV0 new
MA7.5
Magento2
Magento
1 CVEs0 on KEV0 new
UC4.9
Upward Connector
Magento
1 CVEs0 on KEV0 new
UP4.9
Upward Php
Magento
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2021-36036 | MA Magento Magento | 7.2 | Sep 6 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload… |
| CVE-2021-36023 | MA Magento Magento | 7.2 | Sep 6 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout |
| CVE-2021-36021 | MA Magento Magento | 7.2 | Sep 6 | Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled… |
| CVE-2022-42344 | MA Magento Magento | 8.8 | Oct 20 | [CVE-2021-36032] Magento IDOR Leads to Account Takeover |
| CVE-2022-34259 | MA Magento Magento | 5.3 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a… |
| CVE-2022-34258 | MA Magento Magento | 4.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be… |
| CVE-2022-34257 | MA Magento Magento | 6.1 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be… |
| CVE-2022-34256 | MA Magento Magento | 9.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in… |
| CVE-2022-34255 | MA Magento Magento | 8.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in… |
| CVE-2022-34254 | MA Magento Magento | 8.8 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory… |
| CVE-2022-34253 | MA Magento Magento | 7.2 | Aug 16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module |
| CVE-2021-28567 | MA Magento Magento | 6.5 | Sep 8 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module |
| CVE-2021-28566 | MA Magento Magento | 2.7 | Sep 8 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png… |
| CVE-2021-28585 | MA Magento Magento | 5.3 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer… |
| CVE-2021-28584 | MA Magento Magento | 7.2 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child… |
| CVE-2021-28583 | MA Magento Magento | 4.2 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename… |
| CVE-2021-28563 | MA Magento Magento | 6.5 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint |
| CVE-2021-28556 | MA Magento Magento | 4.8 | Jun 28 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies |
| CVE-2021-21064 | UC Upward Connector Magento | 4.9 | Feb 25 | Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature |
| CVE-2021-21014 | MA Magento Magento | 9.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass |
| CVE-2021-21032 | MA Magento Magento | 5.6 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions |
| CVE-2021-21031 | MA Magento Magento | 5.6 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions |
| CVE-2021-21030 | MA Magento Magento | 8.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature |
| CVE-2021-21029 | MA Magento Magento | 4.8 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter |
| CVE-2021-21027 | MA Magento Magento | 4.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API |
| CVE-2021-21026 | MA Magento Magento | 5.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module |
| CVE-2021-21025 | MA Magento Magento | 9.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates |
| CVE-2021-21024 | MA Magento Magento | 9.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module |
| CVE-2021-21023 | MA Magento Magento | 4.8 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console |
| CVE-2021-21022 | MA Magento Magento | 5.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module |
| CVE-2021-21020 | MA Magento Magento | 5.3 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module |
| CVE-2021-21019 | MA Magento Magento | 9.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module |
| CVE-2021-21018 | MA Magento Magento | 9.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module |
| CVE-2021-21016 | MA Magento Magento | 9.1 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI |
| CVE-2021-21015 | MA Magento Magento | 8.0 | Feb 11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller |
| CVE-2020-24407 | MA Magento Magento | 9.1 | Nov 9 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution |
| CVE-2020-24406 | MA Magento Magento | 3.7 | Nov 9 | When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during… |
| CVE-2020-24405 | MA Magento Magento | 4.3 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module |
| CVE-2020-24404 | MA Magento Magento | 2.7 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component |
| CVE-2020-24403 | MA Magento Magento | 2.7 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component |
| CVE-2020-24402 | MA Magento Magento | 4.9 | Nov 9 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component |
| CVE-2020-24401 | MA Magento Magento | 6.5 | Nov 9 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability |
| CVE-2020-24400 | MA Magento Magento | 7.1 | Nov 9 | Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure |
| CVE-2020-24408 | MA Magento Magento | 6.1 | Oct 16 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component |
| CVE-2020-15151 | MA Magento Magento | 8.0 | Aug 20 | OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site… |
| CVE-2020-9692 | MA Magento Magento | 6.5 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability |
| CVE-2020-9691 | MA Magento Magento | 9.6 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability |
| CVE-2020-9690 | MA Magento Magento | 4.2 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability |
| CVE-2020-9689 | MA Magento Magento | 6.5 | Jul 29 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability |
| CVE-2020-9665 | MA Magento Magento | 6.1 | Jul 22 | Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability |
| CVE-2020-9664 | MA Magento Magento | 9.8 | Jul 22 | Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability |
| CVE-2020-9632 | MA Magento Magento | 9.8 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability |
| CVE-2020-9631 | MA Magento Magento | 9.8 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability |
| CVE-2020-9630 | MA Magento Magento | 9.8 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability |
| CVE-2020-9591 | MA Magento Magento | 7.5 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability |
| CVE-2020-9588 | MA Magento Magento | 7.2 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability |
| CVE-2020-9587 | MA Magento Magento | 7.5 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability |
| CVE-2020-9585 | MA Magento Magento | 9.8 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability |
| CVE-2020-9584 | MA Magento Magento | 5.4 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability |
| CVE-2020-9583 | MA Magento Magento | 9.8 | Jun 26 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability |