CVE-2024-20716

CVE-2024-20716 affects Adobe Commerce Open Source and Magento: versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier suffer an Uncontrolled Resource Consumption vulnerability, enabling a high-privileged, non-interactive attacker to exhaust resources and cause denial-of-service. Root cause is uncontro...

CVE-2024-20717 Stored admin XSS via PayPal authentication certificate

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2024-20716 Force high-usage of resources by generating unlimited coupons: Adobe Commerce

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the applicatio...

CVE-2024-20716 Force high-usage of resources by generating unlimited coupons: Adobe Commerce

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the applicatio...

CVE-2024-20717 Stored admin XSS via PayPal authentication certificate

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser wh...

CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which...

CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which...

CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which...

CVE-2024-20718

Adobe Commerce (Magento Open Source) versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a CSRF vulnerability that can bypass security features and cause the victim to perform unintended actions. The issue requires user interaction and arises from a CSRF flaw in the product’s reques...

CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse...

CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse...

CVE-2024-20719

CVE-2024-20719 is a stored XSS vulnerability in Adobe Commerce (Magento) affecting versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier. The issue allows an authenticated admin to inject malicious scripts that run in the victim’s admin pages, potentially enabling elevation to admin access. Root caus...

CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse...

CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user...

CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user...

CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user...

Adobe Commerce Cross-Site Scripting Vulnerability

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. A cross-site scripting vulnerability previously existed in Adobe Commerce versions 2.4.6-p3 and 2.4.5-p5 and 2.4.4-p6, which stemmed from the presence of Stored Cross-Site Scripting XSS that could be...

Adobe Commerce 操作系统命令注入漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from an operating system command injection vulnerability that stems from the presence of operating system command injection, whic...

PT-2024-1795 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page...

PT-2024-1798 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could...