Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: Adobe Commerce — helpx.adobe.com/security/products/magento/apsb24-03.html Clear all filters
TI-2024-13520 CVE-2024-20716 · GHSA-c9h9-h5gf-885r

Force high-usage of resources by generating unlimited coupons: Adobe Commerce

Priority LOW 24

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00874 Published 2024-02-15 Fixed in 2.4.6-p4, 2.4.5-p6 +1 CWE-400
TI-2024-13521 CVE-2024-20717 · GHSA-4fxx-ppqm-m98c

Stored admin XSS via PayPal authentication certificate

Priority LOW 25

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulner…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00442 Published 2024-02-15 No fix listed CWE-79
TI-2024-13522 CVE-2024-20718 · GHSA-hqgj-4396-hmxv

[Spain] CSRF to delete Requisition Lists at Adobe Commerce

Priority LOW 32

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00759 Published 2024-02-15 Fixed in 2.4.6-p4, 2.4.5-p6 +1 CWE-352
TI-2024-13523 CVE-2024-20719 · GHSA-264g-f7v8-q5qq

[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

Priority MEDIUM 44

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin pa…

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01307 Published 2024-02-15 Fixed in 2.4.6-p4, 2.4.5-p6 +1 CWE-79
TI-2024-13524 CVE-2024-20720 · GHSA-525f-pvj5-vqmq

Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Priority MEDIUM 48

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary co…

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.03687 Published 2024-02-15 Fixed in 2.4.6-p4, 2.4.5-p6 +1 CWE-78