CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33666
https://notcve.org/view.php?id=CVE-2021-33666
When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation. Cuando SAP Commerce Cloud versión 100 aloja un escaparate de JavaScript, es vulnerable al rastreo de MIME, que, en determinadas circunstancias, podría usarse para facilitar un ataque de tipo XSS o la proliferación de malware • https://launchpad.support.sap.com/#/notes/2985562 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6238
https://notcve.org/view.php?id=CVE-2020-6238
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce. SAP Commerce, versiones 6.6, 6.7, 1808, 1811, 1905, no procesa una entrada XML de forma segura en la API Rest del Servlet xyformsweb, conllevando a una Falta de Comprobación XML. Esto afecta la confidencialidad y la disponibilidad (parcialmente) de SAP Commerce. • https://launchpad.support.sap.com/#/notes/2904480 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6201
https://notcve.org/view.php?id=CVE-2020-6201
The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting. SAP Commerce (Testweb Extension), versiones 6.6, 6.7, 1808, 1811, 1905, no codifica suficientemente las entradas controladas por el usuario, debido a que determinados parámetros GET URL son reflejados en las respuestas HTTP sin escape y saneamiento, conllevando a un ataque de tipo Cross Site Scripting Reflejado. • https://launchpad.support.sap.com/#/notes/2876813 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-6200
https://notcve.org/view.php?id=CVE-2020-6200
The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework. SAP Commerce (SmartEdit Extension), versiones 6.6, 6.7, 1808, 1811, es vulnerable a una inyección de plantilla angularjs del lado del cliente, una variante de tipo Cross-Site-Scripting (XSS) que explota las instalaciones de plantillas del framework angular. • https://launchpad.support.sap.com/#/notes/2876413 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 28%CPEs: 7EXPL: 0CVE-2019-0344 – SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
https://notcve.org/view.php?id=CVE-2019-0344
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection. Debido a una deserialización no confiable usada en SAP Commerce Cloud (virtualjdbc extension), versiones 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, es posible ejecutar código arbitrario en una máquina de destino con derechos de usuario 'Hybris', resultando en Inyección de Código. SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection. • https://launchpad.support.sap.com/#/notes/2786035 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 • CWE-502: Deserialization of Untrusted Data •