The vulnerability of the user API module of the software platform for developing and managing online stores Magento Commerce allows a hacker to gain unauthorized access to protected information.

The vulnerability of the user API module of the Magento Commerce software development and management platform is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the Widgets module of the Magento Commerce software development and e-commerce management platform allows a hacker to execute arbitrary code.

The vulnerability of the Widgets module in the Magento Commerce software platform for developing and managing online stores is related to errors in processing XML requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the order formatting module of the Magento Commerce software platform, which is used for developing and managing online stores, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the order processing module of the Magento Commerce software platform for developing and managing online stores is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

The vulnerability of the module for scheduled operations on the Magento Commerce software development and management platform allows a hacker to execute arbitrary code.

The vulnerability of the module for scheduled operations on the Magento Commerce software platform relates to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the “Client Login” module of the Magento Commerce software platform allows a perpetrator to compromise data integrity.

The vulnerability of the “Client Login” module of the Magento Commerce software platform for online store development and management is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise data integrity...

The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in its ability to allow unlimited loading of dangerous files, enabling attackers to execute arbitrary code.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Directory Traversal

magento/module-upward-connector is vulnerable to directory traversal. An attacker with a privilege to access Admin Console is able to upload a malicious YAML file to read arbitrary files from the remote server...

CVE-2021-21064

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

CVE-2021-21064

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

Path traversal

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

CVE-2021-21064 Magento UPWARD-php Path traversal vulnerability via UPWARD Connector

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

CVE-2021-21064

CVE-2021-21064 affects Magento UPWARD-php (versions 1.1.4 and earlier) via the UPWARD Connector (versions 1.1.2 and earlier). The issue is a path traversal vulnerability caused by the upload feature that could let an attacker with admin console access upload a malicious YAML file and read arbitra...

Magento UPWARD-php Path Traversal Vulnerability

Adobe Magento is the United States of America Odobie Adobe company's set of open source PHP e-commerce system . The system provides rights management, search engine and payment gateway and other functions. A security vulnerability exists in Magento UPWARD-php version 1.1.4, which can be exploited...

Exploit for Unrestricted Upload of File with Dangerous Type in Magento

PoC Limited CVE-2021-21014 Magento versions 2.4.1 and ear...

CVE-2021-21014

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2021-21014

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

Design/Logic Flaw

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2021-21014 Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2021-21014

CVE-2021-21014 affects Magento 2.x (2.4.1 and earlier, 2.4.0-p1 and earlier, 2.3.6 and earlier). The root cause is a file upload restriction bypass that can lead to arbitrary code execution when an authenticated admin user uses the vulnerable feature. The available connected docs corroborate the ...

CVE-2021-21020

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources...