CC
Product
Commerce Cloud
On CISA KEVExploited in the wild
18
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 10Low 0
Watch
Add Commerce Cloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0344 In wildKEV | 9.8 | Aug 14 | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Affected: 6.4; 6.5; 6.6; 6.7; 1808; 1811; +1 more |
| CVE-2023-39439 | 9.8 | Aug 8 | SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase Affected: 2211 |
| CVE-2020-6238 | 9.3 | Apr 14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation Affected: 6.6; 6.7; 1808; 1811; 1905 |
| CVE-2024-33003 | 9.1 | Aug 13 | Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher… Affected: 1811; 1905; 2005; 2011; 2105; 2205; +2 more |
| CVE-2019-0343 | 8.8 | Aug 14 | SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by… Affected: 6.4; 6.5; 6.6; 6.7; 1808; 1811; +1 more |
| CVE-2023-42481 | 8.1 | Dec 12 | In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality… Affected: 8.1 |
| CVE-2023-37486 | 7.5 | Aug 8 | Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be… Affected: 2211 |
| CVE-2019-0322 | 7.5 | Jul 10 | SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing… Affected: 6.3; 6.4; 6.5; 6.6; 6.7; 1808; +1 more |
| CVE-2021-33666 | 6.1 | Jun 9 | When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack… Affected: 100 |
| CVE-2020-6201 | 6.1 | Mar 10 | The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are… Affected: 6.6; 6.7; 1808; 1811; 1905 |
| CVE-2026-23684 | 5.9 | Feb 10 | Race condition vulnerability in SAP Commerce Cloud Affected: 2205; 2211 |
| CVE-2021-21445 | 5.4 | Jan 12 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper… Affected: 1808; 1811; 1905; 2005; 2011 |
| CVE-2020-6272 | 5.4 | Oct 15 | SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious… Affected: 1808; 1811; 1905; 2005 |
| CVE-2020-6200 | 5.4 | Mar 10 | The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that… Affected: 6.6; 6.7; 1808; 1811 |
| CVE-2026-24321 | 5.3 | Feb 10 | Information Disclosure vulnerability in SAP Commerce Cloud Affected: 2205; 2211 |
| CVE-2020-26809 | 5.3 | Nov 10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to… Affected: 1808; 1811; 1905; 2005 |
| CVE-2020-6232 | 5.3 | Apr 14 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check Affected: 1811; 1905 |
| CVE-2020-6363 | 4.6 | Oct 15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user Affected: 1808; 1811; 1905; 2005 |
Showing 18