Sap Commerce
10 CVEs affecting Sap Commerce. Latest disclosed: 2024-08-13. Critical: 4, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27602 | Critical | 9.9 | 2021-04-13 | SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to dr… |
CVE-2021-21477 | Critical | 9.9 | 2021-02-09 | SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th… |
CVE-2021-42064 | Critical | 9.8 | 2021-12-14 | If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions… |
CVE-2020-6265 | Critical | 9.8 | 2020-06-09 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication… |
CVE-2022-41204 | High | 8.8 | 2022-10-11 | An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that… |
CVE-2021-40502 | High | 8.8 | 2021-11-10 | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation o… |
CVE-2020-6302 | High | 8.1 | 2020-09-09 | SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get… |
CVE-2020-6264 | High | 7.5 | 2020-06-10 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leadi… |
CVE-2021-27619 | Medium | 6.5 | 2021-05-11 | SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be d… |
CVE-2024-41733 | Medium | 5.3 | 2024-08-13 | In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a giv… |