CVSS: 9.1EPSS: 4%CPEs: 10EXPL: 0CVE-2021-21016 – Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21016
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por medio de la WebAPI. Una explot... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 4%CPEs: 10EXPL: 0CVE-2021-21025 – Magento Commerce XML Injection Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21025
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de XML en las actualizaciones de diseño del producto. Una... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 8%CPEs: 10EXPL: 0CVE-2021-21018 – Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21018
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por medio del mó... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21032 – Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
https://notcve.org/view.php?id=CVE-2021-21032
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), no invalidan adecuadamente las sesiones de usuario. Una explotación con éxito de este problema podrí... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-613: Insufficient Session Expiration •
CVSS: 8.5EPSS: 4%CPEs: 10EXPL: 0CVE-2021-21015 – Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21015
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por m... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 3%CPEs: 10EXPL: 0CVE-2021-21019 – Magento Commerce XML Injection Could Lead To Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-21019
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de XML en el módulo Widgets. Una explotación con éxito podría con... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21020 – Magento Commerce Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2021-21020
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son susceptibles a una vulnerabilidad de omisión del control de acceso en el módulo Login as Customer. Una explotación con éxito podría conll... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-284: Improper Access Control •
CVSS: 9.1EPSS: 2%CPEs: 10EXPL: 0CVE-2021-21024 – Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access
https://notcve.org/view.php?id=CVE-2021-21024
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), están afectadas por una vulnerabilidad de inyección SQL ciega ... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21026 – Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
https://notcve.org/view.php?id=CVE-2021-21026
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), están afectadas por una vulnerabilidad de autorizaci... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-285: Improper Authorization •
CVSS: 4.8EPSS: 2%CPEs: 10EXPL: 0CVE-2021-21023 – Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21023
11 Feb 2021 — Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son susceptibles a una vulnerabilidad de tipo cross-site scripting almac... • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •