235 matches found
CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which...
CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse...
PT-2024-1796 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerabl...
Adobe Commerce 资源管理错误漏洞
Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A resource management error vulnerability exists in Adobe Commerce version 2.4.6-p3 and prior to versions 2.4.5-p5 and 2.4.4-p6, which stems from the...
PT-2024-1798 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier Description: The issue is related to an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could...
PT-2024-3880 · Automationdirect · Automationdirect P3-550E
Name of the Vulnerable Software and Affected Versions: AutomationDirect P3-550E version 1.2.10.9 Description: The issue is related to a heap-based buffer overflow vulnerability in the Programming Software Connection CurrDir functionality. This can be triggered by a specially crafted network packe...
GHSA-CMH9-RX85-XJ38 XSS sidekiq-unique-jobs UI server vulnerability
Summary Cross site scripting XSS potentially exposing cookies / sessions / localStorage, fixed by sidekiq-unique-jobs v8.0.7. Specifically, this is a Reflected Server-Side, Non-Self, Cross Site Scripting vulnerability, considered a P3 on the BugCrowd taxonomy with the following categorization:...
The vulnerability of the Jeecg P3 Biz Chat plugin for the WordPress content management system allows a hacker to read arbitrary files.
The vulnerability of the Jeecg P3 Biz Chat plugin for the WordPress content management system is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files...
SQL Injection
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to SQL Injection due to improper neutralization of special elements used in an SQL command. An attacker can execute arbitrary code by injecting SQL commands without user...
p3-i.com Cross Site Scripting vulnerability OBB-3650281
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-5394 · Adobe · Commerce +1
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6-p1 and earlier Adobe Commerce versions 2.4.5-p3 and earlier Adobe Commerce versions 2.4.4-p4 and earlier Description: The issue is related to insufficient access control in Adobe Commerce and Magento Open Source,...
Missing Support for Integrity Check
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Missing Support for Integrity Check due to improper handling of authorization checks. An attacker can bypass security features and access restricted functionalities without...
Incorrect Authorization
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization due to improper handling of authorization logic. An attacker can bypass security measures and access sensitive user data without requiring user...
Improper Neutralization of Special Elements Used in a Template Engine
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine due to the improper neutralization of special elements used in a template engine. An attacker can...
XML Injection
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to XML Injection through the XML processing mechanism. An attacker can bypass security features by sending a specially crafted XML script. Remediation Upgrade...
CVE-2023-29289
Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interactio...
Authorization
Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user...
Adobe Commerce 输入验证错误漏洞
Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. An input validation error vulnerability exists in Adobe Commerce that stems from the presence of incorrect input validation, resulting in security features being bypassed. Affected products and...
PT-2023-3179 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.6 and earlier Adobe Commerce versions 2.4.5-p2 and earlier Adobe Commerce versions 2.4.4-p3 and earlier Description: The issue is related to an Incorrect Authorization vulnerability that could result in a security...
