CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24403 – Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
https://notcve.org/view.php?id=CVE-2020-24403
09 Nov 2020 — Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de permisos de usuario inapropiados dentro del componente Inventory. Esta vulnerabilidad podría ser abusada por... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24401 – Incorrect permissions following the deletion of a user role or deactivation of a user
https://notcve.org/view.php?id=CVE-2020-24401
09 Nov 2020 — Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de autorización incorrecta. Un usuario aún puede acceder a los recursos aprovisionados con su rol anterior después de que un administrador elimine el rol o deshabilite la cu... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-24402 – Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
https://notcve.org/view.php?id=CVE-2020-24402
09 Nov 2020 — Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de permisos incorrectos en el componente Integrations. Los usuarios autenticados con permisos para la API Resource A... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-276: Incorrect Default Permissions •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-24400 – SQL injection allows arbitrary read from database
https://notcve.org/view.php?id=CVE-2020-24400
09 Nov 2020 — Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database. Magento versiones 2.4.0 y 2.3.5 (y anteriores) están afectadas por una vulnerabilidad de inyección SQL que podría conllevar a una divulgación de información confidencial. Esta vulnerabilidad podría ser explotada por un u... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15244 – RCE in Magento
https://notcve.org/view.php?id=CVE-2020-15244
21 Oct 2020 — In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4. En Magento (paquete rubygems openmage/magento-lts) versiones anteriores a 19.4.8 y 20.0.4, un usuario administrador puede generar credenciales soap que pueden ser usadas para activar una RCE por medio de la inyección de objetos PHP... • https://github.com/OpenMage/magento-lts • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 1%CPEs: 8EXPL: 0CVE-2020-24408 – Stored XSS in customer address upload feature
https://notcve.org/view.php?id=CVE-2020-24408
16 Oct 2020 — Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file. Magento versiones 2.4.0 y 2.3.5p1 (y anteriores) están afectadas por una vulnerabilidad de tipo XSS persistente que permite a usuarios cargar JavaScr... • https://helpx.adobe.com/security/products/magento/apsb20-59.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •