Filtered by vendor Adobe Subscriptions
Filtered by product Adobe Commerce Subscriptions
Total 26 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-36022 1 Adobe 2 Adobe Commerce, Magento Open Source 2024-11-21 9.1 Critical
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
CVE-2021-36020 1 Adobe 2 Adobe Commerce, Magento Open Source 2024-11-21 8.2 High
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
CVE-2021-36012 1 Adobe 2 Adobe Commerce, Magento Open Source 2024-11-21 6.5 Medium
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
CVE-2024-45148 1 Adobe 4 Adobe Commerce, Commerce, Commerce B2b and 1 more 2024-10-16 8.8 High
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction.
CVE-2024-45124 1 Adobe 4 Adobe Commerce, Commerce, Commerce B2b and 1 more 2024-10-12 5.3 Medium
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.
CVE-2024-45116 1 Adobe 4 Adobe Commerce, Commerce, Commerce B2b and 1 more 2024-10-11 8.1 High
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious scripts may be executed within the context of the victim's browser and have high impact on confidentiality and integrity. Exploitation of this issue requires user interaction.