Zaloguj się
Deutsch English Español Polski
Wysoka

Unauthenticated crypto and weak IV in Magento\Framework\Encryption

  • Ujawniono: 20.11.2019
  • Aktualizacja: 11.10.2026 12:17

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka Composer magento/community-edition >= 2.0, < 2.2.6 2.2.6
Paczka Composer magento/project-community-edition >= 2.0, <= 2.0.2 brak poprawki
Magento (rdzeń) magento/community-edition >= 2.0, < 2.2.6, >= 2.0, <= 2.0.2 2.2.6

Odnośniki

Ocena CVSS 7.5/10
Wektor CVSS
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Słabość (CWE)
CWE-327
Platforma
Composer, Magento
Paczka
magento/community-edition, magento/project-community-edition
Ujawniono
20.11.2019
Aktualizacja
11.10.2026 12:17

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-h7qw-mxrm-c6h2 - CC BY 4.0

Historia podatności: magento/community-edition

Wszystkie opisane podatności tej paczki (Magento (rdzeń)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (360) w archiwum
Wszystkich wpisów
360
Pierwsza → ostatnia
11.2019 10.2025
Bez poprawki
3
Wykorzystywana w atakach
3

Rozkład istotności

  • Krytyczna 47
  • Wysoka 104
  • Średnia 192
  • Niska 17

Ujawnienia w latach

Istotność:
  1. Unauthenticated crypto and weak IV in Magento\Framework\Encryption ten wpis
    Wysoka · 7.5 CVE-2016-6485 >= 2.0, < 2.2.6, >= 2.0, <= 2.0.2 2.2.6
  2. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Wysoka · 8.1 CVE-2025-54264 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento provides incorrect authorization through a security feature bypass
    Wysoka · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, <= 2.0.2, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  4. Magento Community Edition Improper Input Validation vulnerability
    Krytyczna · 9.1 Wykorzystywana w atakach CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 brak poprawki
  5. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Wysoka · 8.1 CVE-2025-49555 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento vulnerable to denial of service
    Wysoka · 7.5 CVE-2025-49554 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento has incorrect authorization issue that leads to arbitrary file system read
    Wysoka · 7.5 CVE-2025-49556 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  8. Magento Cross-site Scripting vulnerability
    Wysoka · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, <= 2.0.2, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  9. Magento Improper Authorization leading to security feature bypass
    Wysoka · 8.2 CVE-2025-43585 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  10. Magneto contains stored XSS vulnerability
    Krytyczna · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  11. Improper Authorization vulnerability in Magento and Adobe Commerce
    Krytyczna · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Magento stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Path Traversal
    Wysoka · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Adobe Commerce Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Improper Access Control vulnerability
    Wysoka · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  23. Magento Open Source Improper Authorization vulnerability
    Wysoka · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Open Source Improper Access Control vulnerability
    Wysoka · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  25. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 7.6 CVE-2024-39403 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.1 CVE-2024-39400 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento Path Traversal vulnerability
    Wysoka · 7.7 CVE-2024-39399 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento does not properly restrict excessive authentication attempts
    Wysoka · 7.4 CVE-2024-39398 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39402 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39401 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  31. Magento Open Source Improper Authentication vulnerability
    Krytyczna · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  34. Magento RCE,XSS and other vulnerabilities
    Krytyczna ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  35. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Krytyczna ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  36. Magento Open Source Security Advisory: Patch SUPEE-10975
    Krytyczna ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  37. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Krytyczna ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  38. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Krytyczna ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  39. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Krytyczna ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  40. Magento Open Source allows Improper Input Validation
    Wysoka · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  41. Magento Open Source allows OS Command Injection
    Wysoka · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  42. Magento Open Source allows Cross-Site Scripting (XSS)
    Wysoka · 9.1 CVE-2024-20719 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  43. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Krytyczna · 9.1 CVE-2021-36021 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  44. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Krytyczna · 9.1 CVE-2021-36036 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  45. Magento XML Injection vulnerability in the Widgets Update Layout
    Krytyczna · 9.1 CVE-2021-36023 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  46. Magento Open Source allows Improper Neutralization of Special Elements Used
    Wysoka · 9.1 CVE-2023-38208 >= 2.4.6-p1, < 2.4.6-p2, >= 2.4.5-p1, < 2.4.5-p4, >= 2.4.4-p1, < 2.4.4-p5, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p2, 2.4.5-p4, 2.4.4-p5
  47. Magento Open Source allows Improper Neutralization of Special Elements Used
    Wysoka · 9.1 CVE-2023-29297 >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4
  48. Magento Open Source allows XML Injection
    Wysoka · 7.5 CVE-2023-22247 >= 2.4.5-p1, < 2.4.5-p2, >= 2.4.4-p1, < 2.4.4-p3, <= 2.0.2, = 2.4.5, = 2.4.4 2.4.5-p2, 2.4.4-p3
  49. Magento Improper input validation vulnerability
    Wysoka · 8.8 CVE-2022-42344 < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  50. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    Wysoka · 10.0 CVE-2022-35698 >= 2.4.3-p1, <= 2.4.3-p3, <= 2.0.2, = 2.4.4-p1, = 2.4.4, = 2.4.5, = 2.4.3 brak poprawki
  51. Magento Path Traversal vulnerability
    Wysoka · 8.5 CVE-2022-34254 >= 2.3.0, < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  52. Magento Improper Access Control vulnerability
    Wysoka · 8.8 CVE-2022-34255 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  53. Magento Improper Authorization vulnerability
    Wysoka · 7.5 CVE-2022-34256 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  54. Magento XML Injection vulnerability in the Widgets Module
    Krytyczna · 9.1 CVE-2022-34253 < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  55. Magento Broken authentication and session managememt
    Krytyczna · 9.8 CVE-2019-8149 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  56. Magento remote code execution vulnerability
    Wysoka · 8.8 CVE-2019-8154 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  57. Magento 2 Community Edition SQLi Vulnerability
    Krytyczna · 9.8 CVE-2019-7139 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  58. Magento XML Injection vulnerability in the 'City' field
    Wysoka CVE-2021-36020 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  59. Magento XML Injection vulnerability in the Widgets Update Layout
    Wysoka · 7.2 CVE-2021-36022 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  60. Magento is affected by an improper input validation vulnerability
    Wysoka · 8.8 CVE-2021-36032 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  61. Magento has an XML Injection vulnerability
    Krytyczna CVE-2021-36028 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  62. Magento is affected by an improper input validation vulnerability while saving a customer's details
    Krytyczna · 9.1 CVE-2021-36025 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  63. Magento is affected by an os command injection via the Data collection endpoint
    Wysoka · 7.2 CVE-2021-36024 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  64. Magento XML Injection vulnerability in the Widgets Module
    Krytyczna CVE-2021-36033 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  65. Magento allows attackers to alter the price of items
    Wysoka CVE-2021-36030 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  66. Magento improper authorization vulnerability
    Wysoka · 7.2 CVE-2021-36029 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  67. Magento Path Traversal vulnerability via the `theme[preview_image]` parameter
    Wysoka CVE-2021-36031 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  68. Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension
    Wysoka · 8.0 CVE-2021-36043 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  69. Magento executes code via the API File Option Upload Extension
    Krytyczna · 9.1 CVE-2021-36042 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  70. Magento vulnerable to file upload attack
    Wysoka · 7.2 CVE-2021-36041 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  71. Magento affected by remote code execution via a file upload
    Wysoka · 7.2 CVE-2021-36034 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  72. Magento has a file extension restrictions bypass
    Krytyczna · 9.1 CVE-2021-36040 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  73. Magento affected by a server-side denial-of-service using a GraphQL field
    Wysoka · 7.5 CVE-2021-36044 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  74. Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
    Wysoka · 7.5 CVE-2021-28583 >= 2.4.0, < 2.4.2-p1, < 2.3.7, <= 2.0.2 2.4.2-p1, 2.3.7
  75. Magento stored cross-site scripting (XSS) in the customer address upload feature
    Wysoka · 8.1 CVE-2021-21030 < 2.3.6, >= 2.4.0, < 2.4.1-p1, <= 2.0.2 2.3.6, 2.4.1-p1
  76. Magento XML injection in the Widgets module
    Krytyczna · 9.1 CVE-2021-21019 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  77. Magento Blind SQL Injection in the Search module
    Krytyczna · 9.1 CVE-2021-21024 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  78. Magento vulnerable to a file upload restriction bypass
    Krytyczna · 9.1 CVE-2021-21014 < 2.3.6-p1, >= 2.4.0, < 2.4.2, <= 2.0.2 2.3.6-p1, 2.4.2
  79. Magento XPath Injection
    Krytyczna · 9.1 CVE-2021-21025 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1, <= 2.0.2 2.3.6-p1, 2.4.1-p1
  80. Magento OS Command Injection
    Krytyczna · 9.1 CVE-2021-21018 < 2.3.6, >= 2.4.0, < 2.4.1-p1 2.3.6, 2.4.1-p1
  81. Magento OS command injection via the WebAPI
    Krytyczna · 9.1 CVE-2021-21016 < 2.3.6-p1, >= 2.4.0, < 2.4.2, <= 2.0.2 2.3.6-p1, 2.4.2
Pokaż więcej (20) Widać 81 z 151

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.