Skip to contentAdobe Commerce vulnerabilities
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Improper Access Control (CWE-284)CVE-2024-45118Fix available6.5 Medium
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Improper Access Control (CWE-284)CVE-2024-45149Fix available2.7 Low
- adobe commerce, commerce b2b, magento +2 moreAdobe Commerce | Incorrect Authorization (CWE-863)CVE-2024-45125Fix available4.3 Medium
- adobe commerce, magento +1 moreA user without ship permissions can ship the ordersCVE-2024-39419Fix available4.3 Medium
- adobe commerce, magento +1 moreStored XSS through Webhook module public key configurationCVE-2024-39403Fix available7.6 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39418Fix available5.4 Medium
- adobe commerce, magento +1 moreAn unauthorized user can export the Invoiced Sales ReportCVE-2024-39413Fix available4.3 Medium
- adobe commerce, magento +1 more[Paris] Path Traversal lead to local file readCVE-2024-39399Fix available7.7 High
- adobe commerce, magento +1 moreAdobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2024-39408Fix available4.3 Medium
- adobe commerce, magento +1 moreAn unauthorized user can export the Shipping ReportCVE-2024-39417Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2024-39410Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39407Fix available4.3 Medium
- adobe commerce, magento +1 moreOTP 2FA can be bruteforcedCVE-2024-39398Fix available7.4 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)CVE-2024-39401Fix available8.4 High
- adobe commerce, magento +1 moreAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)CVE-2024-393979.0 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2024-39409Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39411Fix available4.3 Medium
- adobe commerce, magento +1 moreUnauthorized user can export Orders Sale ReportCVE-2024-39416Fix available4.3 Medium
- adobe commerce, magento +1 moreBeing able to import/export tax rates without proper privilegesCVE-2024-39414Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39412Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)CVE-2024-39402Fix available8.4 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)CVE-2024-39406Fix available6.8 Medium
- adobe commerce, magento +1 moreA user without Shop Policy Parameters section privilege can alter the shop policy parameters sectionCVE-2024-39404Fix available4.3 Medium
- adobe commerce, magento +1 moreDOM XSS through integrations can impact other adminsCVE-2024-39400Fix available8.1 High
- adobe commerce, magento +1 moreAn unauthorized user can export the Tax Sales ReportCVE-2024-39415Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39405Fix available4.3 Medium
- adobe commerce, commerce webhooks, magento +2 moreInsecure Direct Object Reference - An attacker can able to erase the victim quote detailsCVE-2024-34106Fix available5.3 Medium
- adobe commerce, commerce webhooks, magento +2 moreCustomer account takeover via web API call & subsequent password resetCVE-2024-34103Fix available8.1 High
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Input Validation (CWE-20)CVE-2024-34109Fix available7.2 High
- adobe commerce, commerce webhooks, magento +2 moreSSRF in service connectorCVE-2024-34111Fix available6.5 Medium
- adobe commerce, commerce webhooks, magento +2 moreRCE in the Adobe Commerce Webhook module through a legit webhook definitionCVE-2024-34110Fix available7.2 High
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Access Control (CWE-284)CVE-2024-34107Fix available5.3 Medium
- adobe commerce, commerce webhooks, magento +2 moreStored Cross Site Scripting in Order CommentCVE-2024-34105Fix available4.8 Medium
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-34104Fix available8.2 High
- adobe commerce, commerce and magento open source, commerce webhooks +1 more +3 moreXXE can expose crypt key and other secrets granting full admin accessCVE-2024-34102In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- adobe commerce, commerce webhooks, magento +1 more +3 moreLarge attack surface through legit webhook usage in Adobe CommerceCVE-2024-34108Fix available9.1 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Improper Input Validation (CWE-20)CVE-2024-20758Fix available9.0 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)CVE-2024-20759Fix available8.1 High
- adobe commerceStored admin XSS via PayPal authentication certificateCVE-2024-207175.4 Medium
- adobe commerceForce high-usage of resources by generating unlimited coupons: Adobe CommerceCVE-2024-20716Fix available4.9 Medium
- adobe commerce[Spain] CSRF to delete Requisition Lists at Adobe CommerceCVE-2024-20718Fix available4.3 Medium
- adobe commerce[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297CVE-2024-20719Fix available9.1 Critical
- adobe commerceCommand injection in data collector backup due to insufficient patching of CVE-2023-38208CVE-2024-20720Fix available9.1 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)CVE-2023-38251Fix available5.3 Medium
- adobe commerce, magento +1 moreValidate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrappingCVE-2023-38219Fix available8.7 High
- adobe commerce, magento +1 moreFull page cache enumeration via cookie X-Magento-VaryCVE-2023-38220Fix available7.5 High
- adobe commerce, magento +1 moreError based file extraction via PHP filter chains during product bulk import logicCVE-2023-26367Fix available4.9 Medium
- adobe commerce, magento +1 moreValidate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-26366Fix available6.8 Medium
- adobe commerce, magento +1 moreIncorrect Authorization - Customer account takeoverCVE-2023-38218Fix available8.8 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)CVE-2023-38250Fix available8.0 High
- Show moreLoading…