Skip to contentRunzero Platform vulnerabilities
- 1e platform1E-Exchange-DisplayMessage instruction allows for arbitrary code executionCVE-2023-59649.9 Critical
- 1e platform1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code executionCVE-2023-451639.9 Critical
- 1e platform1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code executionCVE-2023-451619.9 Critical
- orchid platformOrchid Deserialization of Untrusted Data vulnerability leads to Remote Code ExecutionCVE-2023-36825Fix available9.7 Critical
- runzero platform, shopware +1 moreImproper Output Neutralization in Log Module in shopwareCVE-2023-22733Fix available2.7 Low
- runzero platform, shopware +1 moreInsufficient Session Expiration in Administration in shopwareCVE-2023-22732Fix available3.7 Low
- runzero platform, shopware +1 moreImproper Control of Generation of Code in Twig rendered views in shopwareCVE-2023-22731Fix available10.0 Critical
- runzero platform, shopware +1 moreImproper Input Validation of Clearance sale in cartCVE-2023-22730Fix available5.3 Medium
- runzero platform, shopware +1 moreImproper Input Newsletter subscription option validation in shopwareCVE-2023-22734Fix available4.3 Medium
- runzero platform, shopware +1 moreImproper Access Control in shopwareCVE-2022-24872Fix available8.1 High
- runzero platform, shopware +1 moreServer-Side Request Forgery (SSRF) in ShopwareCVE-2022-24871Fix available7.2 High
- runzero platform, shopware +1 moreInsufficient Session Expiration in shopwareCVE-2022-24744Fix available2.6 Low
- runzero platform, shopware +1 moreGuest session is shared between customers in shopwareCVE-2022-24745Fix available4.8 Medium
- runzero platform, shopware +1 moreHTML injection possibility in voucher code formCVE-2022-24746Fix available6.1 Medium
- runzero platform, shopware +1 moreHTTP caching is marking private HTTP headers as publicCVE-2022-24747Fix available6.3 Medium
- runzero platform, shopware +1 moreIncorrect Authentication in shopwareCVE-2022-24748Fix available6.8 Medium
- oroinc oroplatform, platform +1 moreJavaScript Prototype Pollution in oro/platformCVE-2021-43852Fix available8.8 High
- oroinc oroplatform, platform +1 moreXSS vulnerability in oro/platformCVE-2021-41236Fix available6.9 Medium
- runzero platform, shopware +1 moreAuthenticated server-side request forgery in file upload via URL.CVE-2021-37711Fix available8.8 High
- runzero platform, shopware +1 moreCross-Site Scripting via SVG media filesCVE-2021-37710Fix available8.0 High
- runzero platform, shopware +1 moreInsecure direct object reference of log files of the Import/Export featureCVE-2021-37709Fix available6.5 Medium
- runzero platform, shopware +1 moreCommand injection in mail agent settingsCVE-2021-37708Fix available8.8 High
- runzero platform, shopware +1 moreManipulation of product reviews via APICVE-2021-37707Fix available6.5 Medium
- runzero platform, shopware +1 morePrivate files publicly accessible with Cloud Storage providersCVE-2021-32717Fix available7.5 High
- runzero platform, shopware +1 moreInternal hidden fields are visible on to many associations in admin apiCVE-2021-32716Fix available4.4 Medium
- runzero platform, shopware +1 moreCreation of order credits was not validated by acl in admin ordersCVE-2021-32709Fix available4.9 Medium
- runzero platform, shopware +1 morePotential Session Hijacking in ShopwareCVE-2021-32710Fix available5.9 Medium
- runzero platform, shopware +1 moreLeak of information via Store-APICVE-2021-32711Fix available9.1 Critical
- orchid platformXSS in platformCVE-2020-15263Fix available8.0 High