CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2020-6264
https://notcve.org/view.php?id=CVE-2020-6264
SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure. SAP Commerce, versiones - 6.7, 1808, 1811, 1905, puede permitir a un atacante acceder a la información bajo determinadas condiciones que de otro modo estarían restringidas, conllevando a una Divulgación de Información • https://launchpad.support.sap.com/#/notes/2906366 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-6265
https://notcve.org/view.php?id=CVE-2020-6265
SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials. SAP Commerce, versiones - 6.7, 1808, 1811, 1905, y SAP Commerce (Data Hub), versiones - 6.7, 1808, 1811, 1905, permite a un atacante omitir una autenticación y/o autorización configurada por el administrador del sistema debido al uso de Credenciales Embebidas • https://launchpad.support.sap.com/#/notes/2918924 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-3572
https://notcve.org/view.php?id=CVE-2017-3572
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component of Oracle Commerce (subcomponent: MDEX). Supported versions that are affected are 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1 and 6.5.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.0 Base Score 7.5 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html http://www.securityfocus.com/bid/97721 •
CVSS: 5.0EPSS: 0%CPEs: 14EXPL: 0CVE-2014-9025
https://notcve.org/view.php?id=CVE-2014-9025
The default checkout completion rule in the commerce_order module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors. La regla de finalización de pago por defecto en el módulo commerce_order en el módulo Drupal Commerce 7.x-1.x anterior a 7.x-1.10 para Drupal usa las direcciones de email como el nombre de usuario para las nuevas cuentas creadas, lo que permite a atacantes remotos obtener información sensible a través de vectores no especificados. • https://www.drupal.org/node/2336327 https://www.drupal.org/node/2336357 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 15EXPL: 0CVE-2012-1639
https://notcve.org/view.php?id=CVE-2012-1639
Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el módulo enproduct/commerce_product.module en el módulo Drupal Commerce para Drupal anteriores a v7.x-1.2, permite a atacantes remotos secuestrar la autenticación de los usuarios para inyectar comandos web o html a través de los parámetros (1) sku o (2) title. • http://drupal.org/node/1416824 http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module http://osvdb.org/78528 http://secunia.com/advisories/47730 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.securityfocus.com/bid/51668 https://exchange.xforce.ibmcloud.com/vulnerabilities/72743 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •