Commerce
by HCL Software
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-38656 | Hig | 0.56 | 8.6 | 0.01 | Dec 12, 2022 | HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes. | ||
| CVE-2020-14274 | Hig | 0.49 | 7.5 | 0.01 | Jan 12, 2021 | Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors. | ||
| CVE-2024-23576 | Hig | 0.46 | 7.1 | 0.00 | May 14, 2024 | Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. | ||
| CVE-2023-37532 | Med | 0.38 | 5.8 | 0.01 | Oct 23, 2023 | HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system. | ||
| CVE-2021-27751 | Med | 0.29 | 4.4 | 0.00 | May 6, 2022 | HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible. | ||
| CVE-2021-27758 | Med | 0.28 | 4.3 | 0.00 | May 6, 2022 | There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account. | ||
| CVE-2021-27785 | Low | 0.25 | 3.9 | 0.00 | Jul 30, 2022 | HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website. | ||
| CVE-2026-21824 | Hig | 0.00 | 8.8 | 0.00 | Jul 20, 2026 | HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. |
- risk 0.56cvss 8.6epss 0.01
HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.
- risk 0.49cvss 7.5epss 0.01
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors.
- risk 0.46cvss 7.1epss 0.00
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
- risk 0.38cvss 5.8epss 0.01
HCL Commerce Remote Store server could allow a remote attacker, using a specially-crafted URL, to read arbitrary files on the system.
- risk 0.29cvss 4.4epss 0.00
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.
- risk 0.28cvss 4.3epss 0.00
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.
- risk 0.25cvss 3.9epss 0.00
HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.
- risk 0.00cvss 8.8epss 0.00
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.