CVE-2024-37294

CVE-2024-37294 – Aimeos denial of service . The vulnerability affects all SaaS and marketplace deployments using Aimeos in versions 2022, 2023, and 2024. The underlying issue leads to a potential denial of service, with a base CVSS v3.1 score of 5.5 (Network, Privileges Required: High, User Inter...

CVE-2024-32144: Missing Authorization

Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14...

PT-2024-4179

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description The issue is related to an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati...

PT-2024-4162

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description The issue is a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields...

PT-2024-4169

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description The issue is related to insufficient authentication procedures in Adobe Commerce, which could allow a remote attacker to escalate their privileges. This could...

PT-2024-4168

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description The issue is related to insufficient authentication procedures in Adobe Commerce, allowing a remote attacker to bypass existing security restrictions. This cou...

PT-2024-4178

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description The issue is related to an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati...

PT-2024-4180 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description: The issue is related to an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability...

PT-2024-24440 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions 2.9.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Welcart e-Commerce. Recommendations: For versions 2.9.14 and earlier, update to a version that contains a fix for thi...

PT-2024-4142 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description: The issue is related to insufficient access control in Adobe Commerce, allowing a remote attacker to bypass existing security restrictions. This could result...

PT-2024-4170

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4-p8 and earlier Adobe Commerce versions 2.4.5-p7 and earlier Adobe Commerce versions 2.4.6-p5 and earlier Adobe Commerce versions 2.4.7 and earlier Description Adobe Commerce and Magento Open Source are affected by...

WordPress plugin Welcart e-Commerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

APSB24-40 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce, Magento Open Source and Adobe Commerce Webhooks Plugin. This update resolves critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution, security feature bypass and privilege escalation...

PT-2024-4485 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read and potentially result in arbitrary co...

Number withdrawn

Aimeos is an open source e-commerce framework for online stores from Aimeos Open Source. This CVE number has been withdrawn...

CVE-2024-1175: Missing Authorization

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deletepayment' function in all versions up to, and including, 16.26.6. This makes it possible for unauthenticated attackers to delete...

Cross-site Scripting (XSS)

Umbraco Commerce is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation allowing authenticated users with access to edit forms to inject unsafe code into form components...

Cross-site Scripting (XSS)

Umbraco Commerce is vulnerable to stored Cross-site scripting XSS. The vulnerability is due to insufficient input validation in the Print Functionality, allowing attackers to inject malicious code...

strong.eram-commerce.com Improper Access Control vulnerability OBB-3931744

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

JVN#15637138: EC-Orange vulnerable to authorization bypass

EC-Orange provided by S-cubism Inc. is an e-commerce website building system package based on an open source software EC-CUBE. EC-Orange contains an authorization bypass vulnerability CWE-639. This is the same issue as JVN51770585 EC-CUBE vulnerable to authorization bypass. Impact A user of the...