CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24403 – Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
https://notcve.org/view.php?id=CVE-2020-24403
09 Nov 2020 — Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de permisos de usuario inapropiados dentro del componente Inventory. Esta vulnerabilidad podría ser abusada por... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24401 – Incorrect permissions following the deletion of a user role or deactivation of a user
https://notcve.org/view.php?id=CVE-2020-24401
09 Nov 2020 — Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de autorización incorrecta. Un usuario aún puede acceder a los recursos aprovisionados con su rol anterior después de que un administrador elimine el rol o deshabilite la cu... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24402 – Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
https://notcve.org/view.php?id=CVE-2020-24402
09 Nov 2020 — Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de permisos incorrectos en el componente Integrations. Los usuarios autenticados con permisos para la API Resource A... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-276: Incorrect Default Permissions •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-24400 – SQL injection allows arbitrary read from database
https://notcve.org/view.php?id=CVE-2020-24400
09 Nov 2020 — Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database. Magento versiones 2.4.0 y 2.3.5 (y anteriores) están afectadas por una vulnerabilidad de inyección SQL que podría conllevar a una divulgación de información confidencial. Esta vulnerabilidad podría ser explotada por un u... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 8EXPL: 0CVE-2020-24408 – Stored XSS in customer address upload feature
https://notcve.org/view.php?id=CVE-2020-24408
16 Oct 2020 — Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de tipo XSS persistente que permite a usuarios cargar JavaScr... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15151 – Observable Timing Discrepancy in OpenMage LTS
https://notcve.org/view.php?id=CVE-2020-15151
19 Aug 2020 — OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2. OpenMage LTS versiones anteriores a 19.4.6 y 20.0.2, permite a atacantes evitar la "fromkey protection" en la interfaz de Administración y aumenta la superficie de ataque para ataques de tipo Cross Site Request Forgery. ... • https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347a • CWE-203: Observable Discrepancy CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.6EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9691
https://notcve.org/view.php?id=CVE-2020-9691
29 Jul 2020 — Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution. Magento versiones 2.3.5-p1 y anteriores, y versiones 2.3.5-p1 y anteriores, presentan una vulnerabilidad de tipo cross-site scripting basada en dom. Una explotación con éxito podría conllevar a una ejecución de código arbitrario • https://helpx.adobe.com/security/products/magento/apsb20-47.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9692
https://notcve.org/view.php?id=CVE-2020-9692
29 Jul 2020 — Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution. Magento versiones 2.3.5-p1 y anteriores, y versiones 2.3.5-p1 y anteriores presentan una vulnerabilidad de omisión de mitigación de seguridad. Una explotación con éxito podría conllevar a una ejecución de código arbitrario • https://helpx.adobe.com/security/products/magento/apsb20-47.html •
CVSS: 4.2EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9690
https://notcve.org/view.php?id=CVE-2020-9690
29 Jul 2020 — Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass. Magento versiones 2.3.5-p1 y anteriores, y versiones 2.3.5-p1 y anteriores, presentan una vulnerabilidad de discrepancia de sincronización observable. Una explotación con éxito podría conllevar a una omisión de comprobación de firma • https://helpx.adobe.com/security/products/magento/apsb20-47.html • CWE-203: Observable Discrepancy •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9689
https://notcve.org/view.php?id=CVE-2020-9689
29 Jul 2020 — Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. Magento versiones 2.3.5-p1 y anteriores, y versiones 2.3.5-p1 y anteriores, presentan una vulnerabilidad de salto de ruta. Una explotación con éxito podría conllevar a una ejecución de código arbitrario • https://helpx.adobe.com/security/products/magento/apsb20-47.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •