CVSS: 5.3EPSS: 0%CPEs: 71EXPL: 0CVE-2024-34106 – Insecure Direct Object Reference - An attacker can able to erase the victim quote details
https://notcve.org/view.php?id=CVE-2024-34106
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de autorización incorre... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 71EXPL: 0CVE-2024-34103 – Customer account takeover via web API call & subsequent password reset
https://notcve.org/view.php?id=CVE-2024-34103
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de aut... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-287: Improper Authentication •
CVSS: 8.3EPSS: 7%CPEs: 71EXPL: 0CVE-2024-34109 – Adobe Commerce | Improper Input Validation (CWE-20)
https://notcve.org/view.php?id=CVE-2024-34109
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de validación de entrada incorrecta que podría provocar la ejecución de código ar... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-20: Improper Input Validation •
CVSS: 8.3EPSS: 3%CPEs: 71EXPL: 0CVE-2024-34110 – RCE in the Adobe Commerce Webhook module through a legit webhook definition
https://notcve.org/view.php?id=CVE-2024-34110
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabil... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 0%CPEs: 71EXPL: 0CVE-2024-34111 – SSRF in service connector
https://notcve.org/view.php?id=CVE-2024-34111
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted request to the server, which could then cause the server to execute arbitrary code. Exploitation of this issue does not require user interaction. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerab... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 10.0EPSS: 0%CPEs: 71EXPL: 0CVE-2024-34107 – Adobe Commerce | Improper Access Control (CWE-284)
https://notcve.org/view.php?id=CVE-2024-34107
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de control de acceso inadecuado que podría provo... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-284: Improper Access Control •
CVSS: 4.8EPSS: 0%CPEs: 71EXPL: 0CVE-2024-34105 – Stored Cross Site Scripting in Order Comment
https://notcve.org/view.php?id=CVE-2024-34105
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de cross-site scripting (XSS) alm... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 71EXPL: 0CVE-2024-34104 – Adobe Commerce | Improper Authorization (CWE-285)
https://notcve.org/view.php?id=CVE-2024-34104
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabil... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-285: Improper Authorization •
CVSS: 10.0EPSS: 94%CPEs: 71EXPL: 28CVE-2024-34102 – Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
https://notcve.org/view.php?id=CVE-2024-34102
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction. Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad d... • https://packetstorm.news/files/id/179640 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.1EPSS: 7%CPEs: 71EXPL: 0CVE-2024-34108 – Large attack surface through legit webhook usage in Adobe Commerce
https://notcve.org/view.php?id=CVE-2024-34108
13 Jun 2024 — Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de validación de entrada incorrecta que podría provocar la ejecución de código arb... • https://helpx.adobe.com/security/products/magento/apsb24-40.html • CWE-20: Improper Input Validation •