CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21427 – Backport for CVE-2021-21024 Blind SQLi from Magento 2
https://notcve.org/view.php?id=CVE-2021-21427
21 Apr 2021 — Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9. Magento-lts es una alternativa de soporte a largo plazo a Magento Community Edition (CE). • https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fvrf-9428-527m • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21426 – Fixes a bug in Zend Framework's Stream HTTP Wrapper
https://notcve.org/view.php?id=CVE-2021-21426
21 Apr 2021 — Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework. Magento-lts es una alternativa de soporte a largo plazo a Magento Community Edition (CE). • https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m496-x567-f98c • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 1CVE-2021-21014 – Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21014
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una omisión de restricción de la carga de archivos. Una explotación con éxito podr... • https://github.com/HoangKien1020/CVE-2021-21014 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 4%CPEs: 10EXPL: 0CVE-2021-21016 – Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21016
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por medio de la WebAPI. Una explot... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 4%CPEs: 10EXPL: 0CVE-2021-21025 – Magento Commerce XML Injection Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21025
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de XML en las actualizaciones de diseño del producto. Una... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 8%CPEs: 10EXPL: 0CVE-2021-21018 – Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21018
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por medio del mó... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21032 – Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
https://notcve.org/view.php?id=CVE-2021-21032
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), no invalidan adecuadamente las sesiones de usuario. Una explotación con éxito de este problema podrí... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-613: Insufficient Session Expiration •
CVSS: 8.5EPSS: 4%CPEs: 10EXPL: 0CVE-2021-21015 – Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21015
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por m... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 3%CPEs: 10EXPL: 0CVE-2021-21019 – Magento Commerce XML Injection Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-21019
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de XML en el módulo Widgets. Una explotación con éxito podría con... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21020 – Magento Commerce Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2021-21020
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son susceptibles a una vulnerabilidad de omisión del control de acceso en el módulo Login as Customer. Una explotación con éxito podría conll... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-284: Improper Access Control •