CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-41204
https://notcve.org/view.php?id=CVE-2022-41204
11 Oct 2022 — An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that allows them to redirect submissions from the affected login form to their own server. This allows them to steal credentials and hijack accounts. A successful attack could compromise the Confidentiality, Integrity, and Availability of the system. Un atacante puede cambiar el contenido de una página de inicio de sesión de SAP Commerce - versiones 1905, ... • https://launchpad.support.sap.com/#/notes/3239152 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-42064
https://notcve.org/view.php?id=CVE-2021-42064
14 Dec 2021 — If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values. Si es configurado para usar una base de datos Oracle y si se crea una consulta usando la api java de búsqueda flexible con una cláusula "in" parametrizada, ... • https://launchpad.support.sap.com/#/notes/3114134 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-40502
https://notcve.org/view.php?id=CVE-2021-40502
10 Nov 2021 — SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to. SAP Commerce - versiones 2105.3, 2011.13, 2005.18, 1905.34, no realiza las comprobaciones de autorización necesarias para un usuario autenticado, lo que da lugar a una escalada de privilegios. Los atacantes autentificados podrán acceder y e... • https://launchpad.support.sap.com/#/notes/3110328 • CWE-862: Missing Authorization •