cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-47577,https://securityvulnerability.io/vulnerability/CVE-2024-47577,Information Disclosure Vulnerability in SAP Commerce Cloud Assisted Service Module,"Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating as authorized admin visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is extremely limited, and the attacker has no control over what data is leaked.",SAP,SAP Commerce Cloud,2.7,LOW,0.0004299999854993075,false,false,false,false,,false,false,2024-12-10T00:11:49.563Z,0
CVE-2024-45278,https://securityvulnerability.io/vulnerability/CVE-2024-45278,SAP Commerce Backoffice vulnerable to XSS,"SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.",SAP,SAP Commerce Backoffice,5.4,MEDIUM,0.00044999999227002263,false,false,false,false,,false,false,2024-10-08T03:21:25.904Z,0
CVE-2024-41733,https://securityvulnerability.io/vulnerability/CVE-2024-41733,SAP Commerce Customer Registration and Login Processes,"In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for an account, but does
not grant access to any customer data beyond this knowledge. The attacker must
already know the e-mail that they wish to test for. The impact on
confidentiality therefore is low and no impact to integrity or availability",SAP,SAP Commerce,5.3,MEDIUM,0.0004600000102072954,false,false,false,false,,false,false,2024-08-13T03:52:25.523Z,0
CVE-2024-41735,https://securityvulnerability.io/vulnerability/CVE-2024-41735,SAP Commerce Backoffice Unsecured User-Controlled Inputs Lead to Cross-Site Scripting (XSS) Vulnerability,"SAP Commerce Backoffice does not sufficiently
encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)
vulnerability causing low impact on confidentiality and integrity of the
application.",SAP,SAP Commerce Backoffice,5.4,MEDIUM,0.00044999999227002263,false,false,false,false,,false,false,2024-08-13T03:49:48.215Z,0
CVE-2024-33003,https://securityvulnerability.io/vulnerability/CVE-2024-33003,OCC API Endpoints Vulnerable to PII Data Exposure,"A vulnerability has been identified in certain OCC API endpoints of SAP Commerce Cloud, which allows for the exposure of Personally Identifiable Information (PII). This issue occurs when sensitive data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, is included directly in the request URL, either as query or path parameters. The compromised integrity and confidentiality of this information can have serious repercussions, making it crucial for organizations using affected versions to assess their security posture. To mitigate the risks associated with this vulnerability, users are advised to apply the appropriate security patches and review their API endpoint configurations.",SAP,SAP Commerce Cloud,9.1,CRITICAL,0.000910000002477318,false,false,false,false,,false,false,2024-08-13T03:36:55.034Z,0
CVE-2024-39597,https://securityvulnerability.io/vulnerability/CVE-2024-39597,SAP Commerce Vulnerability: Misuse of Forgotten Password Functionality Can Grant Access to Non-Isolated Sites,"The vulnerability in SAP Commerce allows a user to exploit the forgotten password functionality, enabling them to gain unauthorized access to a Composable Storefront B2B site where early login and registration features are active. This security issue becomes more critical if the site is not configured to operate as an isolated instance. In such cases, attackers may gain access not only to the vulnerable site but also to other non-isolated early login sites, even if registration is disabled on those platforms. Proper configuration and review of user account approval processes are essential in mitigating this vulnerability.",SAP,SAP Commerce,7.2,HIGH,0.0004299999854993075,false,false,false,false,,false,false,2024-07-09T03:48:11.488Z,0
CVE-2023-42481,https://securityvulnerability.io/vulnerability/CVE-2023-42481,Improper Access Control vulnerability in SAP Commerce Cloud,"In SAP Commerce Cloud, specifically in multiple versions such as HY_COM 1905 and others, an access control vulnerability allows a locked B2B user to exploit the forgotten password feature to restore their access. This misuse occurs particularly when the Composable Storefront is utilized, exposing significant risks to both confidentiality and integrity within the system. Weak access control measures fail to prevent unauthorized account recovery, raising concerns for organizations relying on SAP for secure e-commerce solutions.",SAP,SAP Commerce Cloud,8.1,HIGH,0.0006399999838322401,false,false,false,false,,false,false,2023-12-12T01:15:00.000Z,0
CVE-2023-37486,https://securityvulnerability.io/vulnerability/CVE-2023-37486,Information Disclosure vulnerability in SAP Commerce (OCC API),"Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.",SAP,SAP Commerce (occ Api),5.9,MEDIUM,0.0015300000086426735,false,false,false,false,,false,false,2023-08-08T01:15:00.000Z,0
CVE-2023-39439,https://securityvulnerability.io/vulnerability/CVE-2023-39439,SAP Commerce accepts empty passphrases.,"SAP Commerce Cloud contains a vulnerability that allows users to bypass passphrase security during login. The system may accept an empty passphrase for user ID and passphrase authentication, enabling unauthorized access. This could lead to potential compromises of sensitive data and overall system integrity. Organizations are advised to apply the necessary patches to mitigate this vulnerability and safeguard their systems.",SAP,SAP Commerce,9.8,CRITICAL,0.002139999996870756,false,false,false,false,,false,false,2023-08-08T01:15:00.000Z,0
CVE-2022-41204,https://securityvulnerability.io/vulnerability/CVE-2022-41204,,"An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system.",SAP,SAP Commerce,8.8,HIGH,0.0022100000642240047,false,false,false,false,,false,false,2022-10-11T00:00:00.000Z,0
CVE-2021-42064,https://securityvulnerability.io/vulnerability/CVE-2021-42064,,"If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized ""in"" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized ""in"" clause accepts more than 1000 values.",SAP,SAP Commerce,9.8,CRITICAL,0.0024399999529123306,false,false,false,false,,false,false,2021-12-14T15:44:14.000Z,0
CVE-2021-40502,https://securityvulnerability.io/vulnerability/CVE-2021-40502,,"SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to.",SAP,SAP Commerce,8.8,HIGH,0.0010400000028312206,false,false,false,false,,false,false,2021-11-10T15:24:42.000Z,0
CVE-2021-33666,https://securityvulnerability.io/vulnerability/CVE-2021-33666,,"When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation.",SAP,SAP Commerce Cloud,4.7,MEDIUM,0.0008399999933317304,false,false,false,false,,false,false,2021-06-09T13:32:45.000Z,0
CVE-2021-27619,https://securityvulnerability.io/vulnerability/CVE-2021-27619,,"SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.",SAP,SAP Commerce (backoffice Search),6.5,MEDIUM,0.0006399999838322401,false,false,false,false,,false,false,2021-05-11T14:19:33.000Z,0
CVE-2021-27602,https://securityvulnerability.io/vulnerability/CVE-2021-27602,,"SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.",SAP,SAP Commerce,9.9,CRITICAL,0.004029999952763319,false,false,false,false,,false,false,2021-04-13T18:41:24.000Z,0
CVE-2021-21477,https://securityvulnerability.io/vulnerability/CVE-2021-21477,,"SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.",SAP,SAP Commerce,9.9,CRITICAL,0.003000000026077032,false,false,false,false,,false,false,2021-02-09T20:43:57.000Z,0
CVE-2021-21445,https://securityvulnerability.io/vulnerability/CVE-2021-21445,,"SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking.",SAP,SAP Commerce Cloud,5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2021-01-12T14:42:03.000Z,0
CVE-2020-26810,https://securityvulnerability.io/vulnerability/CVE-2020-26810,,"SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity.",SAP,SAP Commerce Cloud (accelerator Payment Mock),7.5,HIGH,0.0012400000123307109,false,false,false,false,,false,false,2020-11-10T16:20:28.000Z,0
CVE-2020-26811,https://securityvulnerability.io/vulnerability/CVE-2020-26811,,"SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Request Forgery attack which could lead to retrieval of limited pieces of information about the service with no impact on integrity or availability.",SAP,SAP Commerce Cloud (accelerator Payment Mock),5.3,MEDIUM,0.0020200000144541264,false,false,false,false,,false,false,2020-11-10T16:12:03.000Z,0
CVE-2020-26809,https://securityvulnerability.io/vulnerability/CVE-2020-26809,,"SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.",SAP,SAP Commerce Cloud,5.3,MEDIUM,0.0015999999595806003,false,false,false,false,,false,false,2020-11-10T16:10:56.000Z,0
CVE-2020-6363,https://securityvulnerability.io/vulnerability/CVE-2020-6363,,"SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration.",SAP,SAP Commerce Cloud,4.6,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2020-10-15T01:53:18.000Z,0
CVE-2020-6272,https://securityvulnerability.io/vulnerability/CVE-2020-6272,,"SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability.",SAP,SAP Commerce Cloud,5.4,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2020-10-15T01:46:38.000Z,0
CVE-2020-6302,https://securityvulnerability.io/vulnerability/CVE-2020-6302,,"SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.",SAP,SAP Commerce,6.4,MEDIUM,0.0015899999998509884,false,false,false,false,,false,false,2020-09-09T12:52:14.000Z,0
CVE-2020-6264,https://securityvulnerability.io/vulnerability/CVE-2020-6264,,"SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure.",SAP,SAP Commerce,8.6,HIGH,0.0017800000496208668,false,false,false,false,,false,false,2020-06-10T12:45:10.000Z,0
CVE-2020-6265,https://securityvulnerability.io/vulnerability/CVE-2020-6265,,"SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.",SAP,"SAP Commerce,SAP Commerce (data Hub)",9.8,CRITICAL,0.0024399999529123306,false,false,false,false,,false,false,2020-06-09T18:24:14.000Z,0