Path traversal

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is...

CVE-2021-28584 Magento Commerce path traversal vulnerability in child theme store creation

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is...

CVE-2021-28584

CVE-2021-28584 is a Magento path-traversal vulnerability affecting Magento Commerce/Open Source versions up to 2.4.2, 2.4.1-p1, and 2.3.6-p1. An authenticated admin can exploit a flaw when creating a store with a child theme to perform arbitrary file-system writes. The impact is authenticated acc...

CVE-2021-28585 Magento Commerce improper input validation in customer customer webapi

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

CVE-2021-28585

CVE-2021-28585 affects Magento Commerce/Open Source (Magento), specifically the New customer WebAPI. Affected are Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier, and 2.3.6-p1 and earlier. The root cause is Improper input validation in the New customer WebAPI, which could allow an attack...

CVE-2021-28583 Magento Commerce insecure storage of sensitive documentation

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources...

CVE-2021-28583

Summary of confirmed details: CVE-2021-28583 affects Magento products including Magento Commerce/Open Source versions 2.4.2 and earlier, 2.4.1-p1 and earlier, and 2.3.6-p1 and earlier. The vulnerability is described as a Violation of Secure Design Principles related to RMA PDF filename formats, w...

CVE-2021-28563 Magento Commerce improper Authorization via the 'Create Customer' endpoint

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to...

CVE-2021-28563

Magento Commerce/Open Source prior to 2.4.3 (specifically 2.4.2 and earlier, 2.4.1-p1 and earlier, 2.3.6-p1 and earlier) is affected by an Improper Authorization vulnerability via the Create Customer endpoint. An unauthenticated attacker could cause unauthorized modification of customer data, wit...

CVE-2021-28556 Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...

CVE-2021-28556

CVE-2021-28556 affects Magento Commerce/Open Source: Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier, and 2.3.6-p1 and earlier. The root cause is a DOM-based Cross-Site Scripting vulnerability in the mage-messages cookies, which could allow an unauthenticated attacker to achieve arbitrar...

Missing Handler in @scandipwa/magento-scripts

Impact After changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec and logs commands, effectively making them unusable. Patches Version 1.5.3 contains patches for the problems described above. Workarounds Upgrade to patched or latest...

GHSA-52QP-GWWH-QRG4 Missing Handler in @scandipwa/magento-scripts

Impact After changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec and logs commands, effectively making them unusable. Patches Version 1.5.3 contains patches for the problems described above. Workarounds Upgrade to patched or latest...

CVE-2021-32684

magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec,...

CVE-2021-32684

magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec,...

Design/Logic Flaw

magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec,...

CVE-2021-32684 Missing Handler in @scandipwa/magento-scripts

magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec,...

CVE-2021-32684

CVE-2021-32684 concerns magento-scripts used by Create Magento App. Versions 1.5.1 and 1.5.2 changed a function from synchronous to asynchronous without implementing handlers for start, stop, exec, and logs, rendering those commands unusable. Version 1.5.3 provides patches addressing the problems...

Adobe Magento App 安全漏洞

Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides features such as rights management, search engine and payment gateway. A security vulnerability exists in Create Magento App that stems from the lack of implementati...

Read private customer data reclaiming carts

Klaviyo read customer quotes for guest carts April 28th I've found a endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API. Data -...