CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2021-36038 – Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure
https://notcve.org/view.php?id=CVE-2021-36038
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inapropiada de Entrada en el módulo Multishipping. U... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 11%CPEs: 6EXPL: 0CVE-2021-36028 – Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36028
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de inyección XML cuando se guarda un producto configurable. Un atacante... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 5%CPEs: 6EXPL: 0CVE-2021-36034 – Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36034
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de comprobación Inapropiada de Entrada. Un atacante con privilegios de administrador puede cargar... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 3%CPEs: 6EXPL: 0CVE-2021-36022 – Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36022
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de inyección XML en el diseño de actualización de widgets. Un atacante con pr... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 11%CPEs: 6EXPL: 0CVE-2021-36033 – Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-36033
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de inyección XML en el módulo de widgets. Un atacante con privilegios de administrad... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2021-36037 – Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure
https://notcve.org/view.php?id=CVE-2021-36037
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por una vulnerabilidad de autorización inapropiada. Un atacante autenticado podría aprovechar esta vulnerabilidad... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2021-36012 – Magento Commerce Gift Card Business Logic Error
https://notcve.org/view.php?id=CVE-2021-36012
01 Sep 2021 — Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item. Magento Commerce versiones 2.4.2 (y anteriores), versiones 2.4.2-p1 (y anteriores), y versiones 2.3.7 (y anteriores), están afectadas por un error de lógica de negocio en la mutación gráfica placeOrder. Un atacante autenticado puede aprovechar esta vulne... • https://helpx.adobe.com/security/products/magento/apsb21-64.html • CWE-840: Business Logic Errors •