Advisories · Technology
Saleor.
Every CVE that names Saleor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.3 Medium
Saleor throttling.py get_client_ip excessive authentication
- Saleor
- Authentication bypass
- CWE-799
- CVSS 8.1 High
Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge
- saleor
- Authentication bypass
- CVSS 6.5 Medium
Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check
- saleor
- Broken access control
- CVSS 5.3 Medium
Saleor has a user enumeration vulnerability due to different error messages
- saleor
- CWE-204
- CVSS 5.9 Medium
Saleor has Cross-Account Email Change via Unbound Confirmation Token
- saleor
- Broken access control
- CVSS 7.5 High
Saleor has a resource exhaustion vulnerability in GraphQL queries
- saleor
- Denial of service
- CVSS 7.5 High
Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
- saleor
- Denial of service
- CVSS 8.7 High
Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
- saleor
- Broken access control
- CVSS 8.5 High
Saleor vulnerable to stored XSS via Unrestricted File Upload
- saleor
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 7.2 High
Saleor lacks proper HTML sanitization in rich text fields
- saleor
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Saleor has user enumeration vulnerability due to different error messages
- saleor
- CWE-204
- CVSS 4.2 Medium
Saleor CSRF bypass in refreshToken mutation
- saleor
- Cross-site request forgery (CSRF)
- CVSS 4.8 Medium
Non-constant time HMAC comparison in Adyen plugin in Saleor
- saleor
- Information disclosure
- CWE-208
- CVSS 5.3 Medium
Improper object type validation in saleor
- saleor
- Broken access control
-
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c.
- Saleor