Veille CVE

Recherche « SAP_SE SAP Cloud »

10 CVE

Critique 6 Élevée 2 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « SAP_SE SAP Cloud » ✕
  1. CVE-2026-89113 8.8 Élevée

    SAP_SE SAP Commerce Cloud (OOTB Code)

    SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

  2. CVE-2026-89111 10.0 Critique

    SAP_SE SAP Cloud

    The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

  3. CVE-2026-89105 4.2 Moyenne

    SAP_SE SAP/cloud-security-services-integration-library

    The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.

  4. CVE-2026-58242 3.5 Faible

    SAP_SE SAP Cloud Connector

    SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.

  5. CVE-2026-76969 9.4 Critique

    SAP_SE SAP Cloud Application Programming Model (CAP)

    @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

  6. CVE-2026-66766 7.5 Élevée

    SAP_SE SAP S/4HANA (Manage Supply Protection)

    SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

  7. CVE-2026-58231 10.0 Critique

    SAP_SE SAP Commerce Cloud (Data Hub Adapter)

    SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

  8. CVE-2026-44761 9.1 Critique

    SAP_SE SAP Commerce Cloud

    SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

  9. CVE-2026-34263 9.6 Critique

    SAP_SE SAP Commerce cloud configuration

    Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

  10. CVE-2019-0344 9.8 Critique Exploitée

    SAP SE SAP Commerce Cloud (virtualjdbc extension) · sap commerce_cloud · Sap commerce cloud

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.