CVE-2021-28567 Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for...

CVE-2021-28566 Magento Commerce information disclosure during upload action leveraging a specially crafted file

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated...

The vulnerability of the MSCOMCTL.OCX component in the Microsoft Office software, the Microsoft SQL Server relational database management system, the Microsoft Commerce Server e-commerce software, and the Microsoft Visual FoxPro database development environment allows a perpetrator to execute arbitrary code.

The vulnerability of the MSCOMCTL.OCX component in the Microsoft Office software, the Microsoft SQL Server relational database management system, the Microsoft Commerce Server e-commerce software, and the Microsoft Visual FoxPro database development environment is related to code generation error...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-07508)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications.Pimcore in versions prior to 10.1.2 there is...

The vulnerability of the Magento Commerce software platform for developing and managing online stores relates to the exposure of information due to inconsistencies, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is exploited through information discrepancies. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of measures taken to protect the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Magento Commerce software platform for developing and managing online stores is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2021-93906)

Pimcore is a comprehensive open source enterprise platform for master data management PIM/MDM, user experience management CMS/UX, digital asset management DAM, and e-commerce. cross-site scripting vulnerabilities exist in versions of Pimcore prior to 10.1.2. The vulnerability stems from text valu...

CVE-2021-36044

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field...

CVE-2021-36041

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media directory could lead to remote code execution...

CVE-2021-36044

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field...

CVE-2021-36040

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution...

CVE-2021-36040

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution...

CVE-2021-36039

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability via the quoteId parameter. An attacker can abuse this vulnerability to disclose sensitive information...

CVE-2021-36041

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media directory could lead to remote code execution...

CVE-2021-36042

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code...

CVE-2021-36039

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability via the quoteId parameter. An attacker can abuse this vulnerability to disclose sensitive information...

CVE-2021-36027

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s brows...

CVE-2021-36034

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution...

CVE-2021-36024

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code...

CVE-2021-36028

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...