CVE-2019-0343: Improper Control of Generation of Code

SAP Commerce Cloud Mediaconversion Extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2019-0344: Deserialization of Untrusted Data

Due to unsafe deserialization used in SAP Commerce Cloud virtualjdbc extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection...

CVE-2019-0344

Due to unsafe deserialization used in SAP Commerce Cloud virtualjdbc extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with ‘Hybris’ user rights, resulting in Code Injection. Recent assessments: Assessed Attacker Value: 0 Assess...

PT-2019-4194

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud versions 6.4 through 6.7, 1808, 1811, 1905 Description The issue is related to unsafe deserialization used in the virtualjdbc extension of SAP Commerce Cloud, allowing for the execution of arbitrary code on a target machine...

PT-2019-4195

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud Mediaconversion Extension versions 6.4 through 6.7, 1808, 1811, 1905 Description The issue is related to errors in code generation management in the Mediaconversion component of the SAP Commerce Cloud e-commerce platform. It...

CVE-2019-0322

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

Design/Logic Flaw

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2019-0322

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2019-0322

CVE-2019-0322 affects SAP Commerce Cloud (HY_COM) with versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811. The connected documents describe that an attacker can prevent legitimate users from accessing a service, either by crashing or flooding it, indicating a denial-of-service impact. The root cause is...

CVE-2019-0322: Undefined Security Weakness

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

PT-2019-4351

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud versions 6.3 through 6.7, 1808, 1811 Description The issue is related to insufficient access control in SAP Commerce Cloud, allowing an attacker to cause a denial of service by crashing or flooding the service, thus preventi...

SAP Commerce Cross-Site Scripting Vulnerability

SAP Commerce is a suite of e-commerce solutions from SAP Germany. The product includes components for product content management, experience management, personalization and order management. A cross-site scripting vulnerability exists in SAP Commerce versions prior to 6.7, which arises from a...

Cross site scripting

SAP Commerce previously known as SAP Hybris Commerce, before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0238

SAP Commerce previously known as SAP Hybris Commerce, before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0238

SAP Commerce previously known as SAP Hybris Commerce, before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0238

Summary: SAP Commerce (formerly SAP Hybris Commerce) before version 6.7 contains an XSS vulnerability caused by insufficient encoding of user-controlled inputs. This is documented in multiple sources (NVD CVE-2019-0238 and CNVD entry). Affected scope: pre-6.7 versions; no exact exploitation detai...

PT-2019-11204

Name of the Vulnerable Software and Affected Versions: SAP Commerce versions prior to 6.7 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting XSS issue. Recommendations: For versions prior to 6.7, update to version 6.7 or later to...

CVE-2019-0238: Improper Neutralization of Input During Web Page Generation

SAP Commerce previously known as SAP Hybris Commerce, before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2505

SAP Commerce (Hybris) storefronts are affected by an input validation issue that can lead to Cross-Site Scripting (XSS). The vulnerability arises from insufficient validation of user-controlled inputs. Fixed in SAP Hybris Commerce versions 6.2, 6.3, 6.4, 6.5, 6.6, and 6.7. The CVE describes a cli...

CVE-2018-2505

SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability in storefronts that are based on the product. Fixed in versions SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7...