CVE-2025-42906: Improper Limitation of a Pathname to a Restricted Directory

SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a lo...

PT-2025-41839

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description SAP Commerce Cloud contains a path traversal issue that could allow users to access web applications, such as the Administration Console, from locations where it is not explicitly...

EUVD-2021-20343

Malware in sbrugna...

EUVD-2020-27513

Malware in sbrugna...

EUVD-2020-19347

Malware in sbrugna...

EUVD-2020-19346

Malware in sbrugna...

EUVD-2020-19345

Malware in sbrugna...

EUVD-2020-27422

Malware in sbrugna...

EUVD-2019-1095

Malware in sbrugna...

EUVD-2019-1116

Malware in sbrugna...

EUVD-2021-8719

Malicious code in bioql PyPI...

EUVD-2024-30748

Malicious code in bioql PyPI...

EUVD-2025-10106

Malicious code in bioql PyPI...

EUVD-2024-42809

Malicious code in bioql PyPI...

EUVD-2023-43163

Malicious code in bioql PyPI...

EUVD-2021-8751

Malicious code in bioql PyPI...

CVE-2023-39439

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase...

CVE-2023-42481

In SAP Commerce Cloud - versions HYCOM 1905, HYCOM 2005, HYCOM2105, HYCOM 2011, HYCOM 2205, COMCLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, d...

CVE-2021-21477

SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability...

CVE-2021-21445

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attack...