4306 matches found
Magento SQL Injection vulnerability
Magento versions 2.4.0 and 2.3.5 and earlier are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database...
GHSA-F2G3-3C6Q-4478 Magento 2 Community Edition Incorrect Authorization
Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account...
GHSA-RWF7-652F-76MV Magento 2 Community Edition vulnerable to Improper Authorization
Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization...
GHSA-PF6W-3PFW-FXVW Magento SQL Injection vulnerability
Magento versions 2.4.0 and 2.3.5 and earlier are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database...
GHSA-HVF5-4JR9-FGHH Magento incorrect permissions vulnerability in the Integrations component
Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorizati...
GHSA-39RW-4M66-82GF Magento incorrect user permissions vulnerability within the Inventory component
Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the...
Magento 2 Community Edition XSS Vulnerability
Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This...
GHSA-JXJC-6XMH-H7MG Magento 2 Community Edition XSS Vulnerability
Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This...
Magento observable timing discrepancy vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...
Magento security mitigation bypass vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution...
Magento DOM-based Cross-site scripting vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution...
GHSA-XGP9-J48H-JJF9 Magento observable timing discrepancy vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...
GHSA-VQG7-8V6X-54RQ Magento security mitigation bypass vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution...
GHSA-G7PC-799Q-743F Magento DOM-based Cross-site scripting vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution...
Magento path traversal vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution...
GHSA-FR6F-XMFX-RRPQ Magento path traversal vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution...
Magento php object injection vulnerability
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution. A patch SUPEE-11346 is available at Magento Open Source Download Page Release Archive Tab Magento Open Source Patches - 1.x...
Magento stored cross-site scripting vulnerability
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. A patch SUPEE-11346 is available at Magento Open Source Download Page Release Archive Tab Magento Open Source...
GHSA-XC4P-J89C-P7X5 Magento stored cross-site scripting vulnerability
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. A patch SUPEE-11346 is available at Magento Open Source Download Page Release Archive Tab Magento Open Source...
GHSA-337C-3RCH-Q35J Magento php object injection vulnerability
Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution. A patch SUPEE-11346 is available at Magento Open Source Download Page Release Archive Tab Magento Open Source Patches - 1.x...