Sap Commerce_cloud
18 CVEs affecting Sap Commerce_cloud. Latest disclosed: 2026-02-10. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0344 | Critical | 9.8 | 2019-08-14 | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbi… |
CVE-2020-6238 | Critical | 9.3 | 2020-04-14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida… |
CVE-2023-39439 | High | 8.8 | 2023-08-08 | SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase. |
CVE-2019-0343 | High | 8.8 | 2019-08-14 | SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that… |
CVE-2023-42481 | High | 8.1 | 2023-12-12 | In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten pas… |
CVE-2019-0322 | High | 7.5 | 2019-07-10 | SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate… |
CVE-2024-33003 | High | 7.4 | 2024-08-13 | Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon… |
CVE-2021-33666 | Medium | 6.1 | 2021-06-09 | When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facili… |
CVE-2020-6201 | Medium | 6.1 | 2020-03-10 | The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL p… |
CVE-2026-23684 | Medium | 5.9 | 2026-02-10 | A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being… |
CVE-2023-37486 | Medium | 5.9 | 2023-08-08 | Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which wo… |
CVE-2021-21445 | Medium | 5.4 | 2021-01-12 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type hea… |
CVE-2020-6272 | Medium | 5.4 | 2020-10-15 | SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to… |
CVE-2020-6200 | Medium | 5.4 | 2020-03-10 | The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scri… |
CVE-2026-24321 | Medium | 5.3 | 2026-02-10 | SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive info… |
CVE-2020-26809 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence… |
CVE-2020-6232 | Medium | 5.3 | 2020-04-14 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects conf… |
CVE-2020-6363 | Medium | 4.6 | 2020-10-15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established afte… |