CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 1CVE-2021-21014 – Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21014
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una omisión de restricción de la carga de archivos. Una explotación con éxito podría conllevar a una ejecución de código arbitraria por parte de un atacante autenticado. • https://github.com/HoangKien1020/CVE-2021-21014 https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21016 – Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21016
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por medio de la WebAPI. Una explotación con éxito podría conllevar a una ejecución de código remota por parte de un atacante autenticado. • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21025 – Magento Commerce XML Injection Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21025
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de XML en las actualizaciones de diseño del producto. Una explotación con éxito podría conllevar a una ejecución de código arbitraria por parte de un atacante autenticado. • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21018 – Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2021-21018
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a una inyección de comandos del Sistema Operativo por medio del módulo scheduled operation. Una explotación con éxito podría conllevar a una ejecución de código arbitraria por parte de un atacante autenticado. • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2021-21032 – Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
https://notcve.org/view.php?id=CVE-2021-21032
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation. Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), no invalidan adecuadamente las sesiones de usuario. Una explotación con éxito de este problema podría conllevar a un acceso no autorizado a recursos restringidos. • https://helpx.adobe.com/security/products/magento/apsb21-08.html • CWE-613: Insufficient Session Expiration •