Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2024-34102

XXE can expose crypt key and other secrets granting full admin access

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34111

SSRF in service connector

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34110

RCE in the Adobe Commerce Webhook module through a legit webhook definition

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34109

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34108

Large attack surface through legit webhook usage in Adobe Commerce

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34107

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34106

Insecure Direct Object Reference - An attacker can able to erase the victim quote details

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34105

Stored Cross Site Scripting in Order Comment

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34104

Adobe Commerce | Improper Authorization (CWE-285)

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento
CVE-2024-34103

Customer account takeover via web API call & subsequent password reset

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Commerce Commerce Webhooks Magento