Vulnerabilities > Adobe > Magento > High

DATE CVE VULNERABILITY TITLE RISK
2024-11-12 CVE-2024-49521 Server-Side Request Forgery (SSRF) vulnerability in Adobe Commerce
Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass.
network
low complexity
adobe CWE-918
7.7
2024-10-10 CVE-2024-45116 Cross-site Scripting vulnerability in Adobe Commerce and Magento
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code.
network
low complexity
adobe CWE-79
8.1
2024-10-10 CVE-2024-45117 Unspecified vulnerability in Adobe Commerce and Magento
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read.
network
low complexity
adobe
7.6
2024-10-10 CVE-2024-45148 Unspecified vulnerability in Adobe Commerce and Magento
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass.
network
low complexity
adobe
8.8
2024-08-14 CVE-2024-39398 Improper Restriction of Excessive Authentication Attempts vulnerability in Adobe Commerce
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass.
network
high complexity
adobe CWE-307
7.4
2024-08-14 CVE-2024-39399 Path Traversal vulnerability in Adobe Commerce
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.
network
low complexity
adobe CWE-22
7.7
2024-08-14 CVE-2024-39400 Cross-site Scripting vulnerability in Adobe Commerce
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.
network
low complexity
adobe CWE-79
8.1
2024-08-14 CVE-2024-39401 OS Command Injection vulnerability in Adobe Commerce
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker.
network
low complexity
adobe CWE-78
8.4
2024-08-14 CVE-2024-39402 OS Command Injection vulnerability in Adobe Commerce
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker.
network
low complexity
adobe CWE-78
8.4
2024-08-14 CVE-2024-39403 Cross-site Scripting vulnerability in Adobe Commerce
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.
network
low complexity
adobe CWE-79
7.6