CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47173 – Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups
https://notcve.org/view.php?id=CVE-2024-47173
24 Oct 2024 — Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue. • https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-qxgx-hvg3-v92w • CWE-270: Privilege Context Switching Error •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39319 – aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
https://notcve.org/view.php?id=CVE-2024-39319
26 Sep 2024 — aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue. • https://github.com/aimeos/ai-controller-frontend/commit/2ad5c062a629af374da470a319914c321c9bfee2 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37295 – Aimeos Core remote code execution in web server context
https://notcve.org/view.php?id=CVE-2024-37295
11 Jun 2024 — Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue. Aimeos es un framework de comercio electrónico de código abierto para tiendas online. A partir de la versión 2024.01.1 y antes de la versión 2024.04.5, un usuario con privilegios administrativ... • https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c • CWE-73: External Control of File Name or Path •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37294 – Aimeos denial of service vulnerability in SaaS and marketplace setups
https://notcve.org/view.php?id=CVE-2024-37294
11 Jun 2024 — Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch. Aimeos es un framework de comercio electrónico de código abierto para tiendas online. Todas las configuraciones de SaaS y de mercado que utilizan la versión de Aimeos de 2022/2023/2024 se ven afectad... • https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p • CWE-270: Privilege Context Switching Error •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28380
https://notcve.org/view.php?id=CVE-2021-28380
16 Mar 2021 — The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account. La extensión de aimeos (también se conoce como tienda de Aimeos y e-commerce framework) versiones anteriores a 19.10.12 y versiones 20.x anteriores a 20.10.5 para TYPO3, permite un ataque de tipo XSS por medio de una cuenta de usuario de backend • https://typo3.org/security/advisory/typo3-ext-sa-2021-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •