CVSS: 9.1EPSS: 0%CPEs: 12EXPL: 0CVE-2022-24093 – Adobe Commerce post-auth improper input validation leads to remote code execution
https://notcve.org/view.php?id=CVE-2022-24093
12 Sep 2023 — Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution. Las versiones 2.4.3-p1 (y anteriores) y 2.3.7-p2 (y anteriores) de Adobe Commerce están afectadas por una vulnerabilidad de validación de entrada incorrecta. La explotación de este problema no requiere la interacción del usuario y podría dar lugar a... • https://helpx.adobe.com/security/products/magento/apsb22-13.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 2%CPEs: 12EXPL: 0CVE-2023-38207 – Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read
https://notcve.org/view.php?id=CVE-2023-38207
09 Aug 2023 — Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction. Las versiones 2.4.6-p1 (y anteriores), 2.4.5-p3 (y anteriores) y 2.4.4-p4 (y anteriores) de Adobe Commerce están afectadas por una vulnerabilidad de inyección XML (también conocida como Blind XPath Injection) que podría provo... • https://helpx.adobe.com/security/products/magento/apsb23-42.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 9.1EPSS: 15%CPEs: 12EXPL: 0CVE-2023-38208 – Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
https://notcve.org/view.php?id=CVE-2023-38208
09 Aug 2023 — Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-42.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 12EXPL: 0CVE-2023-38209 – Adobe Commerce Incorrect Authorization Security feature bypass
https://notcve.org/view.php?id=CVE-2023-38209
09 Aug 2023 — Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-42.html • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2023-22247 – Adobe Commerce XML Injection Arbitrary file system read
https://notcve.org/view.php?id=CVE-2023-22247
27 Mar 2023 — Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-17.html • CWE-91: XML Injection (aka Blind XPath Injection) •
CVSS: 4.8EPSS: 15%CPEs: 12EXPL: 0CVE-2023-22249 – Adobe Commerce Stored XSS Arbitrary code execution
https://notcve.org/view.php?id=CVE-2023-22249
27 Mar 2023 — Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. • https://helpx.adobe.com/security/products/magento/apsb23-17.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2023-22250 – Adobe Commerce Improper Access Control Security feature bypass
https://notcve.org/view.php?id=CVE-2023-22250
27 Mar 2023 — Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction. • https://helpx.adobe.com/security/products/magento/apsb23-17.html • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2023-22251 – Adobe Commerce Incorrect Authorization Security feature bypass
https://notcve.org/view.php?id=CVE-2023-22251
27 Mar 2023 — Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure. • https://helpx.adobe.com/security/products/magento/apsb23-17.html • CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 0%CPEs: 20EXPL: 0CVE-2022-42344 – [CVE-2021-36032] Magento IDOR Leads to Account Takeover
https://notcve.org/view.php?id=CVE-2022-42344
20 Oct 2022 — Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation. Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) están afectadas por una vulnerabilidad de comprobación de entrada inapropiada. Un atacante autenticado puede desencadenar una referencia de objeto ... • https://helpx.adobe.com/security/products/magento/apsb22-38.html • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2022-35689 – Adobe Commerce Improper Access Control Security feature bypass
https://notcve.org/view.php?id=CVE-2022-35689
14 Oct 2022 — Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction. Adobe Commerce versiones 2.4.4-p1 (y anteriores) y 2.4.5 (y anteriores) están afectadas por una vulnerabilidad de Control de Acceso Inapropiado que podría resultar en una omi... • https://helpx.adobe.com/security/products/magento/apsb22-48.html • CWE-284: Improper Access Control •