Drupal Commerce Core vulnerabilities

An Exposure of Sensitive Information Through Data Queries vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.

A Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Commerce Core module allows unauthorized actions to be performed on behalf of a logged-in user. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.

An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.

An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.

An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.2.0.

A Missing Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

A Stored Cross-Site Scripting (XSS) vulnerability was found in Drupal Commerce Core due to improper input neutralization during page generation. It affects versions from 3.3.0 to 3.3.6.