SAP SE SAP Commerce
10 CVEs affecting SAP SE SAP Commerce. Latest disclosed: 2022-10-11. Critical: 5, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27602 | Critical | 9.9 | 2021-04-13 | SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to dr… |
CVE-2021-21477 | Critical | 9.9 | 2021-02-09 | SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th… |
CVE-2021-42064 | Critical | 9.8 | 2021-12-14 | If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions… |
CVE-2020-6265 | Critical | 9.8 | 2020-06-09 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication… |
CVE-2020-6238 | Critical | 9.3 | 2020-04-14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida… |
CVE-2022-41204 | High | 8.8 | 2022-10-11 | An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that… |
CVE-2021-40502 | High | 8.8 | 2021-11-10 | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation o… |
CVE-2020-6302 | High | 8.1 | 2020-09-09 | SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get… |
CVE-2020-6264 | High | 7.5 | 2020-06-10 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leadi… |
CVE-2020-6232 | Medium | 5.3 | 2020-04-14 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects conf… |