CVE-2023-42481

CVE-2023-42481 affects SAP Commerce Cloud (HY_COM 1905–2205; COM_CLOUD 2211) where a locked B2B user can abuse the forgotten-password flow to unblock and re-gain access when the Composable Storefront is used. Root cause: weak access controls in the forgotten-password mechanism. Implications: impa...

CVE-2023-37486: Use of Cache Containing Sensitive Information

Under certain conditions SAP Commerce OCC API - versions HYCOM 2105, HYCOM 2205, COMCLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and...

Design/Logic Flaw

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2019-0322

CVE-2019-0322 affects SAP Commerce Cloud (HY_COM) with versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811. The connected documents describe that an attacker can prevent legitimate users from accessing a service, either by crashing or flooding it, indicating a denial-of-service impact. The root cause is...

CVE-2019-0322: Undefined Security Weakness

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...