Browse CVEs

HIGH 7.2 CVE-2021-36036 Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within … Magento 2.3.7 / 2.4.2+ Fix from $1,9502023-09-06 HIGH 7.2 CVE-2021-36021 Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability withi… Magento 2.3.7 / 2.4.2+ Fix from $1,9502023-09-06 HIGH 7.2 CVE-2021-36023 Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the W… Magento 2.3.7 / 2.4.2+ Fix from $1,9502023-09-06 MEDIUM 6.5 CVE-2021-28567 Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in … Magento after 2.4.2 Fix from $1,6002021-09-08 HIGH 7.2 CVE-2021-28584 Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating … Magento 2.3.6+ Fix from $1,9502021-06-28 MEDIUM 5.3 CVE-2021-28585 Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in… Magento 2.3.6+ Fix from $1,6002021-06-28 MEDIUM 6.5 CVE-2021-28563 Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via t… Magento 2.3.7+ Fix from $1,6002021-06-28 CRITICAL 9.1 CVE-2021-21014 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful e… Magento 2.3.6+ Fix from $2,3002021-02-11 CRITICAL 9.1 CVE-2021-21018 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operati… Magento 2.3.6+ Fix from $2,3002021-02-11 CRITICAL 9.1 CVE-2021-21019 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successfu… Magento 2.3.6+ Fix from $2,3002021-02-11 CRITICAL 9.1 CVE-2021-21024 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Searc… Magento 2.3.6+ Fix from $2,3002021-02-11 CRITICAL 9.1 CVE-2021-21025 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. S… Magento 2.3.6+ Fix from $2,3002021-02-11 HIGH 8.1 CVE-2021-21030EPSS 6% Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the cus… Magento 2.3.6+ Fix from $1,9502021-02-11 MEDIUM 5.6 CVE-2021-21031 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitat… Magento 2.3.6+ Fix from $1,6002021-02-11 MEDIUM 5.6 CVE-2021-21032 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitat… Magento 2.3.6+ Fix from $1,6002021-02-11 MEDIUM 5.3 CVE-2021-21020 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the … Magento 2.3.6+ Fix from $1,6002021-02-11 MEDIUM 5.3 CVE-2021-21022 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in … Magento 2.3.6+ Fix from $1,6002021-02-11 MEDIUM 5.3 CVE-2021-21026 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the i… Magento 2.3.6+ Fix from $1,6002021-02-11 CRITICAL 9.1 CVE-2021-21016 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successfu… Magento 2.3.6+ Fix from $2,3002021-02-11 HIGH 8.0 CVE-2021-21015 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attri… Magento 2.3.6+ Fix from $1,9502021-02-11 CRITICAL 9.1 CVE-2020-24407EPSS 5% Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. T… Magento 2.3.5+ Fix from $2,3002020-11-09 HIGH 7.1 CVE-2020-24400 Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. Th… Magento 2.3.5+ Fix from $1,9502020-11-09 MEDIUM 6.5 CVE-2020-24401 Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisio… Magento 2.3.5+ Fix from $1,6002020-11-09 MEDIUM 6.1 CVE-2020-24408 Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via … Magento after 2.3.4 Fix from $1,6002020-10-16 CRITICAL 9.6 CVE-2020-9691EPSS 6% Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could le… Magento 2.3.5+ Fix from $2,3002020-07-29 MEDIUM 6.5 CVE-2020-9689 Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary … Magento 2.3.5+ Fix from $1,6002020-07-29 MEDIUM 6.5 CVE-2020-9692 Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead t… Magento 2.3.5+ Fix from $1,6002020-07-29 CRITICAL 9.8 CVE-2020-9583EPSS 6% Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerabili… Magento after 2.3.4 Fix from $2,3002020-06-26 CRITICAL 9.8 CVE-2020-9585 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mit… Magento after 2.3.4 Fix from $2,3002020-06-26 CRITICAL 9.8 CVE-2020-9630 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerab… Magento after 2.3.4 Fix from $2,3002020-06-26