CVSS: 9.1EPSS: 0%CPEs: 12EXPL: 0CVE-2022-24093 – Adobe Commerce post-auth improper input validation leads to remote code execution
https://notcve.org/view.php?id=CVE-2022-24093
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution. Las versiones 2.4.3-p1 (y anteriores) y 2.3.7-p2 (y anteriores) de Adobe Commerce están afectadas por una vulnerabilidad de validación de entrada incorrecta. La explotación de este problema no requiere la interacción del usuario y podría dar lugar a una ejecución de código arbitrario posterior a la autenticación. • https://helpx.adobe.com/security/products/magento/apsb22-13.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2023-38207 – Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read
https://notcve.org/view.php?id=CVE-2023-38207
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction. Las versiones 2.4.6-p1 (y anteriores), 2.4.5-p3 (y anteriores) y 2.4.4-p4 (y anteriores) de Adobe Commerce están afectadas por una vulnerabilidad de inyección XML (también conocida como Blind XPath Injection) que podría provocar una lectura menor del sistema de archivos arbitrario. La explotación de este problema no requiere la interacción del usuario. • https://helpx.adobe.com/security/products/magento/apsb23-42.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 0%CPEs: 12EXPL: 0CVE-2023-38208 – Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
https://notcve.org/view.php?id=CVE-2023-38208
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-42.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2023-38209 – Adobe Commerce Incorrect Authorization Security feature bypass
https://notcve.org/view.php?id=CVE-2023-38209
Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-42.html • CWE-863: Incorrect Authorization •
CVSS: 4.8EPSS: 0%CPEs: 12EXPL: 0CVE-2023-22249 – Adobe Commerce Stored XSS Arbitrary code execution
https://notcve.org/view.php?id=CVE-2023-22249
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. • https://helpx.adobe.com/security/products/magento/apsb23-17.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •