Remote code execution

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

CVE-2021-21477

CVE-2021-21477 affects SAP Commerce Cloud versions 1808, 1811, 1905, 2005 and 2011. A misconfiguration of default user permissions lets certain users with required privileges edit DroolsRule ruleContents, enabling injection of malicious code that leads to Remote Code Execution and impacts confide...

CVE-2021-21477

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

思爱普 SAP Commerce Cloud 代码注入漏洞

SAP Commerce Cloud is an e-commerce cloud platform from SAP Germany. The platform provides enterprise-level e-commerce business support. A remote code execution vulnerability exists in SAP Commerce Cloud versions 1808, 1811, 1905, 2005, and 2011. An authenticated attacker can exploit the...

SAP Commerce Cloud Input Validation Error Vulnerability

SAP Commerce Cloud is an e-commerce cloud platform from SAP Germany. The platform provides enterprise-level e-commerce business support. SAP Commerce Cloud versions 1808, 1811, 1905, 2005, and 2011 suffer from an Input Validation Error vulnerability, which is caused by an authenticated attacker...

CVE-2021-21445

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attack...

CVE-2021-21445

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attack...

Cross site scripting

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attack...

CVE-2021-21445

CVE-2021-21445 affects SAP Commerce Cloud releases 1808, 1811, 1905, 2005, and 2011, where an authenticated attacker can cause invalid data to be sent in the HTTP Content-Type header due to input validation issues. This could enable advanced attacks such as cross-site scripting and page hijacking...

CVE-2021-21445

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attack...

SAP Commerce Cloud 环境问题漏洞

SAP Commerce Cloud is an e-commerce cloud platform from SAP Germany. The platform provides enterprise-level e-commerce business support. SAP Commerce Cloud versions 1808, 1811, 1905, 2005, and 2011 suffer from an Input Validation Error vulnerability, which is caused by an authenticated attacker...

SAP Commerce Cloud Denial of Service Vulnerability

SAP Commerce Cloud is a cloud-native omnichannel commerce solution for B2B, B2C and B2B2C companies. A denial of service vulnerability exists in SAP Commerce Cloud 1808, 1811, 1905, 2005. An attacker could exploit this vulnerability by submitting a specially crafted request to a specific SAP...

SAP Commerce Cloud Server-Side Request Forgery Vulnerability

SAP Commerce Cloud is a cloud-native omnichannel commerce solution for B2B, B2C and B2B2C companies. A server-side request forgery vulnerability exists in SAP Commerce Cloud 1808, 1811, 1905, 2005. An attacker could exploit the vulnerability by submitting a specially crafted request to a specific...

SAP Commerce Cloud Information Disclosure Vulnerability

SAP Commerce Cloud is a cloud-native omnichannel commerce solution for B2B, B2C and B2B2C companies. An information disclosure vulnerability exists in SAP Commerce Cloud 1808, 1811, 1905, 2005. An attacker can bypass existing authentication and permission checks via the '/medias' endpoint, which...

CVE-2020-26810

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2020-26809

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and...

CVE-2020-26811

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...

CVE-2020-26809

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and...

CVE-2020-26810

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2020-26811

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...