CVE-2020-26810

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2020-26811

CVE-2020-26811 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, and 2005. The cited issue is a Server-Side Request Forgery (SSRF) where an unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL, which is processed without furthe...

CVE-2020-26811

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...

CVE-2020-26809

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and...

CVE-2020-26809

SAP Commerce Cloud (versions 1808, 1811, 1905, 2005) is affected by CVE-2020-26809 where an attacker can bypass authentication/permission checks via the /medias endpoint, gaining access to Secure Media folders and potentially exposing sensitive data. The root cause is not fully detailed beyond th...

Unspecified Vulnerability in SAP Commerce Cloud

SAP Commerce Cloud is an e-commerce cloud platform from SAP Germany. The platform provides enterprise-level e-commerce business support. There is a security vulnerability in SAP Commerce Cloud and no details of the vulnerability are provided at this time...

SAP Commerce Cloud Cross-Site Scripting Vulnerability

SAP Commerce Cloud is a cloud-based e-commerce platform. A cross-site script execution vulnerability exists in SAP Commerce Cloud versions 1808, 1811, 1905, and 2005. The vulnerability stems from the program not properly encoding user input. An attacker could exploit this recording vulnerability ...

CVE-2020-6363

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...

CVE-2020-6272

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited,...

CVE-2020-6363

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...

CVE-2020-6272

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited,...

CVE-2020-6363

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...

Cross site scripting

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited,...

Session fixation

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...

CVE-2020-6363

CVE-2020-6363 affects SAP Commerce Cloud (versions 1808, 1811, 1905, 2005). The root cause is insufficient session expiration: when a user changes their passphrase, active sessions remain valid, enabling reuse of old session credentials by an attacker. Public documents describe the issue but do n...

CVE-2020-6363

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate...

CVE-2020-6272

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited,...

CVE-2020-6272

The CVE-2020-6272 issue affects SAP Commerce Cloud (versions 1808, 1811, 1905, 2005) and arises from insufficient input encoding in web CMS components. The root cause is improper encoding of user inputs, enabling an authenticated and authorized content manager to inject malicious script into seve...

The vulnerability of the SAP Commerce Cloud e-commerce platform, related to lack of access control, allows a hacker to trigger a service failure.

The vulnerability of the SAP Commerce Cloud e-commerce platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the virtualjdbc component in the SAP Commerce Cloud e-commerce platform allows a hacker to execute arbitrary code.

The vulnerability of the virtualjdbc component in the SAP Commerce Cloud platform is related to errors in code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...