Zaloguj się
Deutsch English Español Polski
Krytyczna

Magento vulnerable to a file upload restriction bypass

  • Ujawniono: 24.05.2022
  • Aktualizacja: 11.10.2026 12:17

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka Composer magento/community-edition < 2.3.6-p1, >= 2.4.0, < 2.4.2 2.3.6-p1, 2.4.2
Paczka Composer magento/project-community-edition <= 2.0.2 brak poprawki
Magento (rdzeń) magento/community-edition < 2.3.6-p1, >= 2.4.0, < 2.4.2, <= 2.0.2 2.3.6-p1, 2.4.2

Odnośniki

Ocena CVSS 9.1/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Słabość (CWE)
CWE-434
Platforma
Composer, Magento
Paczka
magento/community-edition, magento/project-community-edition
Ujawniono
24.05.2022
Aktualizacja
11.10.2026 12:17

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-269w-pqc7-68q9 - CC BY 4.0

Historia podatności: magento/community-edition

Wszystkie opisane podatności tej paczki (Magento (rdzeń)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (360) w archiwum
Wszystkich wpisów
360
Pierwsza → ostatnia
11.2019 10.2025
Bez poprawki
3
Wykorzystywana w atakach
3

Rozkład istotności

  • Krytyczna 47
  • Wysoka 104
  • Średnia 192
  • Niska 17

Ujawnienia w latach

Istotność:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    Wysoka · 8.1 CVE-2025-54264 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  2. Magento provides incorrect authorization through a security feature bypass
    Wysoka · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, <= 2.0.2, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento Community Edition Improper Input Validation vulnerability
    Krytyczna · 9.1 Wykorzystywana w atakach CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 brak poprawki
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    Wysoka · 8.1 CVE-2025-49555 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  5. Magento vulnerable to denial of service
    Wysoka · 7.5 CVE-2025-49554 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    Wysoka · 7.5 CVE-2025-49556 <= 2.0.2, >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento Cross-site Scripting vulnerability
    Wysoka · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, <= 2.0.2, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  8. Magento Improper Authorization leading to security feature bypass
    Wysoka · 8.2 CVE-2025-43585 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  9. Magneto contains stored XSS vulnerability
    Krytyczna · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  10. Improper Authorization vulnerability in Magento and Adobe Commerce
    Krytyczna · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Adobe Commerce Path Traversal
    Wysoka · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Improper Access Control vulnerability
    Wysoka · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    Wysoka · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Open Source Improper Authorization vulnerability
    Wysoka · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  23. Magento Open Source Improper Access Control vulnerability
    Wysoka · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Stored Cross-Site Scripting (XSS) vulnerability
    Wysoka · 7.6 CVE-2024-39403 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  25. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    Wysoka · 8.1 CVE-2024-39400 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento Path Traversal vulnerability
    Wysoka · 7.7 CVE-2024-39399 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento does not properly restrict excessive authentication attempts
    Wysoka · 7.4 CVE-2024-39398 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39402 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    Wysoka · 8.4 CVE-2024-39401 <= 2.0.2, >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento Open Source Improper Authentication vulnerability
    Krytyczna · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  31. Magento Open Source Improper Authorization vulnerability
    Wysoka · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Krytyczna · 9.8 Wykorzystywana w atakach CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento RCE,XSS and other vulnerabilities
    Krytyczna ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  34. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Krytyczna ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  35. Magento Open Source Security Advisory: Patch SUPEE-10975
    Krytyczna ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  36. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Krytyczna ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  37. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Krytyczna ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  38. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Krytyczna ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  39. Magento Open Source allows Improper Input Validation
    Wysoka · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  40. Magento Open Source allows OS Command Injection
    Wysoka · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  41. Magento Open Source allows Cross-Site Scripting (XSS)
    Wysoka · 9.1 CVE-2024-20719 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  42. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Krytyczna · 9.1 CVE-2021-36021 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  43. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Krytyczna · 9.1 CVE-2021-36036 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  44. Magento XML Injection vulnerability in the Widgets Update Layout
    Krytyczna · 9.1 CVE-2021-36023 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  45. Magento Open Source allows Improper Neutralization of Special Elements Used
    Wysoka · 9.1 CVE-2023-38208 >= 2.4.6-p1, < 2.4.6-p2, >= 2.4.5-p1, < 2.4.5-p4, >= 2.4.4-p1, < 2.4.4-p5, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p2, 2.4.5-p4, 2.4.4-p5
  46. Magento Open Source allows Improper Neutralization of Special Elements Used
    Wysoka · 9.1 CVE-2023-29297 >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4
  47. Magento Open Source allows XML Injection
    Wysoka · 7.5 CVE-2023-22247 >= 2.4.5-p1, < 2.4.5-p2, >= 2.4.4-p1, < 2.4.4-p3, <= 2.0.2, = 2.4.5, = 2.4.4 2.4.5-p2, 2.4.4-p3
  48. Magento Improper input validation vulnerability
    Wysoka · 8.8 CVE-2022-42344 < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  49. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    Wysoka · 10.0 CVE-2022-35698 >= 2.4.3-p1, <= 2.4.3-p3, <= 2.0.2, = 2.4.4-p1, = 2.4.4, = 2.4.5, = 2.4.3 brak poprawki
  50. Magento Path Traversal vulnerability
    Wysoka · 8.5 CVE-2022-34254 >= 2.3.0, < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  51. Magento Improper Access Control vulnerability
    Wysoka · 8.8 CVE-2022-34255 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  52. Magento Improper Authorization vulnerability
    Wysoka · 7.5 CVE-2022-34256 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  53. Magento XML Injection vulnerability in the Widgets Module
    Krytyczna · 9.1 CVE-2022-34253 < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  54. Magento Broken authentication and session managememt
    Krytyczna · 9.8 CVE-2019-8149 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  55. Magento remote code execution vulnerability
    Wysoka · 8.8 CVE-2019-8154 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  56. Magento 2 Community Edition SQLi Vulnerability
    Krytyczna · 9.8 CVE-2019-7139 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  57. Magento XML Injection vulnerability in the 'City' field
    Wysoka CVE-2021-36020 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  58. Magento XML Injection vulnerability in the Widgets Update Layout
    Wysoka · 7.2 CVE-2021-36022 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  59. Magento is affected by an improper input validation vulnerability
    Wysoka · 8.8 CVE-2021-36032 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  60. Magento has an XML Injection vulnerability
    Krytyczna CVE-2021-36028 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  61. Magento is affected by an improper input validation vulnerability while saving a customer's details
    Krytyczna · 9.1 CVE-2021-36025 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  62. Magento is affected by an os command injection via the Data collection endpoint
    Wysoka · 7.2 CVE-2021-36024 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  63. Magento XML Injection vulnerability in the Widgets Module
    Krytyczna CVE-2021-36033 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  64. Magento allows attackers to alter the price of items
    Wysoka CVE-2021-36030 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  65. Magento improper authorization vulnerability
    Wysoka · 7.2 CVE-2021-36029 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  66. Magento Path Traversal vulnerability via the `theme[preview_image]` parameter
    Wysoka CVE-2021-36031 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  67. Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension
    Wysoka · 8.0 CVE-2021-36043 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  68. Magento executes code via the API File Option Upload Extension
    Krytyczna · 9.1 CVE-2021-36042 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  69. Magento vulnerable to file upload attack
    Wysoka · 7.2 CVE-2021-36041 <= 2.0.2, < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  70. Magento affected by remote code execution via a file upload
    Wysoka · 7.2 CVE-2021-36034 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  71. Magento has a file extension restrictions bypass
    Krytyczna · 9.1 CVE-2021-36040 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  72. Magento affected by a server-side denial-of-service using a GraphQL field
    Wysoka · 7.5 CVE-2021-36044 <= 2.0.2, >= 2.4.2-p1, < 2.4.2-p2, < 2.3.7-p1, = 2.4.2, = 2.3.7 2.4.2-p2, 2.3.7-p1
  73. Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
    Wysoka · 7.5 CVE-2021-28583 >= 2.4.0, < 2.4.2-p1, < 2.3.7, <= 2.0.2 2.4.2-p1, 2.3.7
  74. Magento stored cross-site scripting (XSS) in the customer address upload feature
    Wysoka · 8.1 CVE-2021-21030 < 2.3.6, >= 2.4.0, < 2.4.1-p1, <= 2.0.2 2.3.6, 2.4.1-p1
  75. Magento XML injection in the Widgets module
    Krytyczna · 9.1 CVE-2021-21019 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  76. Magento Blind SQL Injection in the Search module
    Krytyczna · 9.1 CVE-2021-21024 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1 2.3.6-p1, 2.4.1-p1
  77. Magento vulnerable to a file upload restriction bypass ten wpis
    Krytyczna · 9.1 CVE-2021-21014 < 2.3.6-p1, >= 2.4.0, < 2.4.2, <= 2.0.2 2.3.6-p1, 2.4.2
  78. Magento XPath Injection
    Krytyczna · 9.1 CVE-2021-21025 < 2.3.6-p1, >= 2.4.0, < 2.4.1-p1, <= 2.0.2 2.3.6-p1, 2.4.1-p1
  79. Magento OS Command Injection
    Krytyczna · 9.1 CVE-2021-21018 < 2.3.6, >= 2.4.0, < 2.4.1-p1 2.3.6, 2.4.1-p1
  80. Magento OS command injection via the WebAPI
    Krytyczna · 9.1 CVE-2021-21016 < 2.3.6-p1, >= 2.4.0, < 2.4.2, <= 2.0.2 2.3.6-p1, 2.4.2
  81. Magento OS command injection via the customer attribute save controller
    Wysoka · 8.0 CVE-2021-21015 < 2.3.6-p1, >= 2.4.0, < 2.4.2 2.3.6-p1, 2.4.2
  82. Magento 2 Community Edition RCE via Unsafe File Upload
    Krytyczna · 9.1 CVE-2020-24407 < 2.4.1, <= 2.0.2 2.4.1
  83. Magento SQL Injection vulnerability
    Wysoka · 7.1 CVE-2020-24400 < 2.3.6, >= 2.4.0, < 2.4.1 2.3.6, 2.4.1
  84. Magento DOM-based Cross-site scripting vulnerability
    Krytyczna · 9.6 CVE-2020-9691 < 2.3.5-p2, <= 2.0.2 2.3.5-p2
  85. Magento business logic error vulnerability
    Krytyczna · 9.8 CVE-2020-9630 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  86. Magento security mitigation bypass vulnerability
    Krytyczna · 9.8 CVE-2020-9632 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  87. Magento security mitigation bypass vulnerability
    Krytyczna · 9.8 CVE-2020-9631 >= 2.3.0, < 2.3.4-p2, <= 2.2.11, <= 2.0.2 2.3.4-p2
  88. Magento defense-in-depth security mitigation vulnerability
    Wysoka · 7.5 CVE-2020-9591 >= 2.3.0, < 2.3.4-p2, <= 2.2.11 2.3.4-p2
  89. Magento Defense-in-depth security mitigation vulnerability
    Krytyczna · 9.8 CVE-2020-9585 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  90. Magento command injection vulnerability
    Krytyczna · 9.8 CVE-2020-9583 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  91. Magento Signature verification bypass
    Wysoka · 7.2 CVE-2020-9588 < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  92. Magento command injection vulnerability
    Krytyczna · 9.8 CVE-2020-9582 >= 2.3.0, < 2.3.4-p2, < 2.2.12, <= 2.0.2 2.3.4-p2, 2.2.12
  93. Magento authorization bypass vulnerability
    Wysoka · 7.5 CVE-2020-9587 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  94. Magento command injection vulnerability
    Krytyczna · 9.8 CVE-2020-9578 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  95. Magento Security mitigation bypass vulnerability
    Krytyczna · 9.8 CVE-2020-9580 <= 2.2.11, >= 2.3.0, < 2.3.4-p2, <= 2.0.2 2.3.4-p2
  96. Magento command injection vulnerability
    Krytyczna · 9.8 CVE-2020-9576 >= 2.3.0, < 2.3.4-p2, < 2.2.12, <= 2.0.2 2.3.4-p2, 2.2.12
  97. Magento Security mitigation bypass vulnerability
    Krytyczna · 9.8 CVE-2020-9579 <= 2.2.11, >= 2.3.0, < 2.3.4-p2 2.3.4-p2
  98. Magento security bypass vulnerability
    Krytyczna · 9.8 CVE-2020-3718 >= 2.3.0, < 2.3.4, < 2.2.11 2.3.4, 2.2.11
  99. Magento deserialization vulnerability
    Krytyczna · 9.8 CVE-2020-3716 >= 2.2.0, < 2.2.11, >= 2.3.0, < 2.3.4 2.2.11, 2.3.4
  100. Magento sql injection vulnerability
    Wysoka · 7.5 CVE-2020-3719 >= 2.3.0, < 2.3.4, < 2.2.11 2.3.4, 2.2.11
  101. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 8.8 CVE-2019-8150 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  102. Magento 2 Community Edition SSRF vulnerability
    Wysoka · 7.2 CVE-2019-8156 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  103. Magento Server-Side Request Forgery (SSRF)
    Wysoka · 7.2 CVE-2019-8151 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  104. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 8.8 CVE-2019-8159 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p2 2.2.10, 2.3.2-p2
  105. Magento 2 Community Edition XML Injection
    Krytyczna · 9.8 CVE-2019-8158 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  106. Magento 2 Community Edition RCE Vulnerability
    Krytyczna · 9.8 CVE-2019-8144 >= 2.3, < 2.3.2-p1 2.3.2-p1
  107. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 8.8 CVE-2019-8137 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  108. Magento SQL injection via marketing account with access to email templates variables
    Wysoka · 8.8 CVE-2019-8134 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  109. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 7.2 CVE-2019-8141 >= 2.1.0, < 2.1.19, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.1.19, 2.2.10, 2.3.3
  110. Magento 2 Community Edition Insecure Component
    Krytyczna · 9.8 CVE-2019-8136 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  111. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 8.8 CVE-2019-8122 >= 2.1.0, < 2.1.19, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.1.19, 2.2.10, 2.3.3
  112. Magento SQL injection vulnerability
    Wysoka · 8.8 CVE-2019-8130 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  113. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 7.2 CVE-2019-8119 >= 2.1.0, < 2.1.19, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.3 2.1.19, 2.2.10, 2.3.3
  114. Magento 2 Community Edition SQLi Vulnerability
    Wysoka · 8.8 CVE-2019-8127 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  115. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 7.2 CVE-2019-8114 < 1.9.4.3, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2, < 1.9.4.3 1.9.4.3, 2.2.10, 2.3.2-p2
  116. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 8.8 CVE-2019-8111 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  117. Magento 2 Community Edition RCE Vulnerability
    Wysoka · 8.8 CVE-2019-8110 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  118. Magento Information Disclosure via File upload functionality
    Wysoka · 8.8 CVE-2019-8093 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  119. Magento 2 Community Edition Security Bypass
    Wysoka · 7.5 CVE-2019-8112 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
  120. Magento 2 Community Edition RCE Vulnerability via CSRF
    Wysoka · 8.0 CVE-2019-8109 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p1 2.2.10, 2.3.2-p1
Pokaż więcej (20) Widać 120 z 151

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.