CVSS: 9.1EPSS: 3%CPEs: 6EXPL: 0CVE-2021-36040 – Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36040
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inapropiada de Entrada. Un atacante ... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 5%CPEs: 6EXPL: 0CVE-2021-36025 – Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36025
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inaprop... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 31%CPEs: 6EXPL: 0CVE-2021-36020 – Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36020
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de inyección XML en el campo "City". Un atacante no autenticado puede desencadenar un script... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 7%CPEs: 6EXPL: 0CVE-2021-36035 – Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36035
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could make a crafted request to the Adobe Stock API to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inapropiada de Entrada. Un atacante con privilegios de administra... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 3%CPEs: 6EXPL: 0CVE-2021-36024 – Magento Commerce Improper Neutralization of Special Elements Used In A Command
https://notcve.org/view.php?id=CVE-2021-36024
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una Neutralización inapropiada de elementos especiales usados... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.2EPSS: 10%CPEs: 6EXPL: 0CVE-2021-36031 – Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36031
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de Salto de Ruta por medio del parámetro "theme[preview_image]". Un at... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-36039 – Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure
https://notcve.org/view.php?id=CVE-2021-36039
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inapropiada de Entrada por medio del parámetro "quoteId". Un atacante puede abusa... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 5%CPEs: 6EXPL: 0CVE-2021-36029 – Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36029
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de autorización inapropiada. Un atacante con privilegios de administrador podría aprovechar e... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 3%CPEs: 6EXPL: 0CVE-2021-36026 – Magento Commerce Stored Cross-site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2021-36026
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y ... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-36032 – Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation
https://notcve.org/view.php?id=CVE-2021-36032
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inapropiada de Entr... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-20: Improper Input Validation CWE-639: Authorization Bypass Through User-Controlled Key •