nopCommerce Access Control Error Vulnerability

nopCommerce is a set of open source general e-commerce platform. An Access Control Error vulnerability exists in nopCommerce 4.50.2 and prior versions. The vulnerability stems from the presence of improper access control in the application and can be exploited by an attacker to arbitrarily modify...

GHSA-297F-R9W7-W492 Magento Improper input validation vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and...

Magento Improper input validation vulnerability

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and...

CVE-2022-42344

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation...

CVE-2022-42344

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation...

Authorization

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation...

CVE-2022-42344 [CVE-2021-36032] Magento IDOR Leads to Account Takeover

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation...

CVE-2022-42344

CVE-2022-42344 affects Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. The issue is described as an Incorrect Authorization/ improper input validation vulnerability that allows an authenticated attacker to cause information exposure and privilege escalat...

CVE-2022-42344 [CVE-2021-36032] Magento IDOR Leads to Account Takeover

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation...

Adobe Commerce 输入验证错误漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce has an input validation error vulnerability that stems from incorrect input validation. An authenticated attacker can trigger an insecure...

Cross-Site Scripting (XSS)

oro/commerce is vulnerable to cross-site scripting. The vulnerability is due to lack of sanitization in the shipping rule edit page which allows an attacker to inject and execute arbitrary JavaScript...

OroCommerce 跨站脚本漏洞

OroCommerce is an open source business-to-business commerce application from Oro Open Source. A cross-site scripting XSS vulnerability exists in OroCommerce versions 4.1.0 through 4.1.17, 4.2.0 through 4.2.11, and 5.0.0 through 5.0.3, which stems from susceptibility to cross-site scripting attack...

PT-2022-20477 · Unknown · Orocommerce

Name of the Vulnerable Software and Affected Versions: OroCommerce versions 4.1.0 through 4.1.17 OroCommerce versions 4.2.0 through 4.2.11 OroCommerce versions 5.0.0 through 5.0.3 Description: The issue concerns Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. An...

CVE-2022-31037 OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker...

Magento Open Source allows Improper Access Control

Adobe Commerce versions 2.4.3-p3 and earlier, 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature...

GHSA-4VJ2-426R-JM3G Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)

Adobe Commerce versions 2.4.3-p3 and earlier, 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...

Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)

Adobe Commerce versions 2.4.3-p3 and earlier, 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...

CVE-2022-35698

Adobe Commerce versions 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...

CVE-2022-35689

Adobe Commerce versions 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issu...

Improper access control

Adobe Commerce versions 2.4.4-p1 and earlier and 2.4.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issu...