Skip to contentAdobe Magento vulnerabilities
- adobe commerce, magento +1 moreAdobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2024-39410Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39407Fix available4.3 Medium
- adobe commerce, magento +1 moreOTP 2FA can be bruteforcedCVE-2024-39398Fix available7.4 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)CVE-2024-39401Fix available8.4 High
- adobe commerce, magento +1 moreAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)CVE-2024-393979.0 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2024-39409Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39411Fix available4.3 Medium
- adobe commerce, magento +1 moreUnauthorized user can export Orders Sale ReportCVE-2024-39416Fix available4.3 Medium
- adobe commerce, magento +1 moreBeing able to import/export tax rates without proper privilegesCVE-2024-39414Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39412Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)CVE-2024-39402Fix available8.4 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)CVE-2024-39406Fix available6.8 Medium
- adobe commerce, magento +1 moreA user without Shop Policy Parameters section privilege can alter the shop policy parameters sectionCVE-2024-39404Fix available4.3 Medium
- adobe commerce, magento +1 moreDOM XSS through integrations can impact other adminsCVE-2024-39400Fix available8.1 High
- adobe commerce, magento +1 moreAn unauthorized user can export the Tax Sales ReportCVE-2024-39415Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-39405Fix available4.3 Medium
- adobe commerce, commerce webhooks, magento +2 moreInsecure Direct Object Reference - An attacker can able to erase the victim quote detailsCVE-2024-34106Fix available5.3 Medium
- adobe commerce, commerce webhooks, magento +2 moreCustomer account takeover via web API call & subsequent password resetCVE-2024-34103Fix available8.1 High
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Input Validation (CWE-20)CVE-2024-34109Fix available7.2 High
- adobe commerce, commerce webhooks, magento +2 moreSSRF in service connectorCVE-2024-34111Fix available6.5 Medium
- adobe commerce, commerce webhooks, magento +2 moreRCE in the Adobe Commerce Webhook module through a legit webhook definitionCVE-2024-34110Fix available7.2 High
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Access Control (CWE-284)CVE-2024-34107Fix available5.3 Medium
- adobe commerce, commerce webhooks, magento +2 moreStored Cross Site Scripting in Order CommentCVE-2024-34105Fix available4.8 Medium
- adobe commerce, commerce webhooks, magento +2 moreAdobe Commerce | Improper Authorization (CWE-285)CVE-2024-34104Fix available8.2 High
- adobe commerce, commerce and magento open source, commerce webhooks +1 more +3 moreXXE can expose crypt key and other secrets granting full admin accessCVE-2024-34102In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- adobe commerce, commerce webhooks, magento +1 more +3 moreLarge attack surface through legit webhook usage in Adobe CommerceCVE-2024-34108Fix available9.1 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Improper Input Validation (CWE-20)CVE-2024-20758Fix available9.0 Critical
- adobe commerce, magento +1 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)CVE-2024-20759Fix available8.1 High
- adobe commerce, magento +1 moreAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)CVE-2023-38251Fix available5.3 Medium
- adobe commerce, magento +1 moreValidate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrappingCVE-2023-38219Fix available8.7 High
- adobe commerce, magento +1 moreFull page cache enumeration via cookie X-Magento-VaryCVE-2023-38220Fix available7.5 High
- adobe commerce, magento +1 moreError based file extraction via PHP filter chains during product bulk import logicCVE-2023-26367Fix available4.9 Medium
- adobe commerce, magento +1 moreValidate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-26366Fix available6.8 Medium
- adobe commerce, magento +1 moreIncorrect Authorization - Customer account takeoverCVE-2023-38218Fix available8.8 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)CVE-2023-38250Fix available8.0 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)CVE-2023-38249Fix available8.0 High
- adobe commerce, magento +1 moreAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)CVE-2023-38221Fix available8.0 High
- adobe commerce, magento open source +1 moreAdobe Commerce post-auth improper input validation leads to remote code executionCVE-2022-24093Fix available9.1 Critical
- adobe commerce, magento commerce +1 moreValidate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)CVE-2023-38208Fix available9.1 Critical
- adobe commerce, magento commerce +1 moreAdobe Commerce Incorrect Authorization Security feature bypassCVE-2023-38209Fix available6.5 Medium
- adobe commerce, magento, magento commerce +2 moreAdmin-to-admin stored XSS via cache poisoningCVE-2023-29297Fix available9.1 Critical
- adobe commerce, magento, magento commerce +2 more[Cloud] Customer suspects IDOR vulnerabilityCVE-2023-29296Fix available4.3 Medium
- adobe commerce, magento, magento commerce +2 moreInsecure Direct Object Reference (IDOR) in Create Quote FunctionCVE-2023-29295Fix available4.3 Medium
- adobe commerce, magento, magento commerce +2 moreBypass Purchase Order Approval using Company User in Adobe Commerce B2BCVE-2023-29294Fix available4.3 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Improper Input Validation (CWE-20)CVE-2023-29293Fix available2.7 Low
- adobe commerce, magento, magento commerce +2 moreServer Side Request Forgery (SSRF) in FedEx carrier integration configurationCVE-2023-29292Fix available4.9 Medium
- adobe commerce, magento, magento commerce +2 moreServer Side Request Forgery (SSRF) in USPS carrier integration configurationCVE-2023-29291Fix available4.9 Medium
- adobe commerce, magento, magento commerce +2 moreAdobe Commerce Guest Cart Shipping Address Overwrite IDORCVE-2023-29290Fix available5.3 Medium
- adobe commerce, magento, magento commerce +2 moreAdobe Commerce XML Injection Security feature bypassCVE-2023-29289Fix available6.5 Medium
- adobe commerce, magento +1 moreAdobe Commerce | Incorrect Authorization (CWE-863)CVE-2023-29288Fix available4.3 Medium
- Show moreLoading…