Vulnerabilities > Adobe > Magento Open Source

DATE CVE VULNERABILITY TITLE RISK
2023-09-12 CVE-2022-24093 Improper Input Validation vulnerability in Adobe Commerce and Magento Open Source
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability.
network
low complexity
adobe CWE-20
7.2
2022-10-14 CVE-2022-35689 Unspecified vulnerability in Adobe Commerce and Magento Open Source
Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.
network
low complexity
adobe
5.3
2022-10-14 CVE-2022-35698 Cross-site Scripting vulnerability in Adobe Commerce and Magento Open Source
Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability.
network
low complexity
adobe CWE-79
5.4
2021-10-15 CVE-2021-39864 Cross-Site Request Forgery (CSRF) vulnerability in Adobe Commerce and Magento Open Source
Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link.
network
adobe CWE-352
4.3
2021-09-01 CVE-2021-36012 Unspecified vulnerability in Adobe Commerce and Magento Open Source
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation.
network
low complexity
adobe
4.0
2021-09-01 CVE-2021-36020 XML Injection (aka Blind XPath Injection) vulnerability in Adobe Commerce and Magento Open Source
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field.
network
low complexity
adobe CWE-91
7.5
2021-09-01 CVE-2021-36022 XML Injection (aka Blind XPath Injection) vulnerability in Adobe Commerce and Magento Open Source
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout.
network
low complexity
adobe CWE-91
7.2
2021-09-01 CVE-2021-36024 Command Injection vulnerability in Adobe Commerce and Magento Open Source
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint.
network
low complexity
adobe CWE-77
6.5
2021-09-01 CVE-2021-36025 Improper Input Validation vulnerability in Adobe Commerce and Magento Open Source
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file.
network
low complexity
adobe CWE-20
6.5
2021-09-01 CVE-2021-36026 Cross-site Scripting vulnerability in Adobe Commerce and Magento Open Source
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields.
network
adobe CWE-79
4.3