Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2019-0248
Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP Gateway of ABAP Application Server(SAP_GWFND)
References: [{'name': '106471', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106471'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2723142'}]
CVE State: PUBLISHED
Explain CVE-2019-0249
Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP Landscape Management(VCM)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985'}, {'name': '106464', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106464'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2727624'}]
CVE State: PUBLISHED
Explain CVE-2019-0251
The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP BusinessObjects Business Intelligence Platform (Fiori Launchpad)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'name': '106993', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106993'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2638175'}]
CVE State: PUBLISHED
Explain CVE-2019-0254
SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP Disclosure Management
References: [{'name': '107004', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107004'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2706798'}]
CVE State: PUBLISHED
Explain CVE-2019-0255
SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2723570'}, {'name': '106987', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106987'}]
CVE State: PUBLISHED
Explain CVE-2019-0256
Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP Business One Mobile Android App
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2723878'}, {'name': '106995', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106995'}]
CVE State: PUBLISHED
Explain CVE-2019-0257
Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Affected Products: ABAP Platform(SAP Basis)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2728839'}, {'name': '106999', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106999'}]
CVE State: PUBLISHED
Explain CVE-2019-0258
SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Affected Products: SAP Disclosure Management
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2724014'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'name': '106969', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106969'}]
CVE State: PUBLISHED
Explain CVE-2019-0259
SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.
Affected Products: SAP BusinessObjects Business Intelligence Platform Servers (Enterprise)
References: [{'name': '106997', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106997'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2727564'}]
CVE State: PUBLISHED
Explain CVE-2019-0261
Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).
Affected Products: SAP HANA Extended Application Services
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2742027'}, {'name': '106986', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106986'}]
CVE State: PUBLISHED
Explain CVE-2019-0262
SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP WebIntelligence BILaunchPad (Enterprise)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'name': '106998', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106998'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2696714'}]
CVE State: PUBLISHED
Explain CVE-2019-0265
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.
Affected Products: ABAP Platform (KRNL32NUC)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'name': '106972', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106972'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2729710'}, {'name': '107364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107364'}]
CVE State: PUBLISHED
Explain CVE-2019-0266
Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased.
Affected Products: SAP HANA Extended Application Services, advanced model (XS advanced)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2724713'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'name': '106988', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106988'}]
CVE State: PUBLISHED
Explain CVE-2019-0267
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.
Affected Products: SAP Manufacturing Integration and Intelligence
References: [{'name': '106990', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106990'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2686535'}]
CVE State: PUBLISHED
Explain CVE-2019-0268
SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.
Affected Products: SAP BusinessObjects Business Intelligence Platform (CMC Module)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2689259'}, {'name': '107364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107364'}]
CVE State: PUBLISHED
Explain CVE-2019-0269
SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2693962'}, {'name': '107359', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107359'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}]
CVE State: PUBLISHED
Explain CVE-2019-0270
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.
Affected Products: ABAP Platform & Server (KRNL32NUC)
References: [{'name': '107377', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107377'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2727689'}]
CVE State: PUBLISHED
Explain CVE-2019-0271
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform. For more recent updates please refer to Security Note 2870067 (which supersedes the solution of Security Note 2736825) in the reference section below.
Affected Products: ABAP Server
References: [{'name': '107355', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107355'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2870067'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2736825'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}]
CVE State: PUBLISHED
Explain CVE-2019-0274
SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of service). Fixed in versions 3.1 SP03 PL02, SDK 3.1 SP04, or later.
Affected Products: SAP Mobile Platform SDK
References: [{'name': '107360', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107360'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2753497'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}]
CVE State: PUBLISHED
Explain CVE-2019-0275
SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting (XSS) vulnerability.
Affected Products: SAP NetWeaver Java Application Server (J2EE-APPS)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2689925'}, {'name': '107362', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107362'}]
CVE State: PUBLISHED
Explain CVE-2019-0276
Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges.
Affected Products: Banking services from SAP 9.0 (FSAPPL)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}, {'name': '107353', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107353'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2754235'}]
CVE State: PUBLISHED
Explain CVE-2019-0277
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).
Affected Products: SAP HANA Extended Application Services
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2764283'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080'}, {'name': '107356', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107356'}]
CVE State: PUBLISHED
Explain CVE-2019-0278
Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure.
Affected Products: SAP NetWeaver Process Integration (Messaging System)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2741201'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114'}]
CVE State: PUBLISHED
Explain CVE-2019-0279
ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.
Affected Products: SAP BASIS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2753629'}]
CVE State: PUBLISHED
Explain CVE-2019-0280
SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.
Affected Products: SAP Treasury and Risk Management(EA-FINSERV)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2744937'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}]
CVE State: PUBLISHED
Explain CVE-2019-0281
SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: OpenUI5
References: [{'name': '109077', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109077'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2756539'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0282
Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker.
Affected Products: SAP NetWeaver Process Integration (Runtime Workbench)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2742758'}]
CVE State: PUBLISHED
Explain CVE-2019-0283
SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document.
Affected Products: SAP NetWeaver Process Integration (Adapter Engine)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2747683'}]
CVE State: PUBLISHED
Explain CVE-2019-0284
SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.
Affected Products: SAP HANA
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2772376'}]
CVE State: PUBLISHED
Explain CVE-2019-0285
The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.
Affected Products: SAP Crystal Reports for Visual Studio
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.support.sap.com/#/notes/2687663'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/153471/SAP-Crystal-Reports-Information-Disclosure.html'}]
CVE State: PUBLISHED
Explain CVE-2019-0287
Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP BusinessObjects Business Intelligence platform (Central Management Server)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2737278'}, {'name': '108316', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/108316'}]
CVE State: PUBLISHED
Explain CVE-2019-0289
Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP BusinessObjects Business Intelligence platform
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2738796'}]
CVE State: PUBLISHED
Explain CVE-2019-0291
Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP Solution Manager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2748699'}, {'name': '108313', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/108313'}]
CVE State: PUBLISHED
Explain CVE-2019-0293
Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740).
Affected Products: SAP Solution Manager system (ST-PI)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2756625'}, {'name': '108324', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/108324'}]
CVE State: PUBLISHED
Explain CVE-2019-0298
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.
Affected Products: SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2773086'}, {'name': '108314', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/108314'}]
CVE State: PUBLISHED
Explain CVE-2019-0301
Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing.
Affected Products: SAP Identity Management (REST Interface)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2784307'}]
CVE State: PUBLISHED
Explain CVE-2019-0303
SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.
Affected Products: SAP BusinessObjects Business Intelligence Platform (Administration Console)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2637997'}]
CVE State: PUBLISHED
Explain CVE-2019-0304
FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.
Affected Products: SAP NetWeaver AS ABAP Platform(KRNL32NUC)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2719530'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0305
Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data.
Affected Products: SAP NetWeaver Process Integration(SAP_XIESR and SAP_XITOOL)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2755502'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0306
SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names.
Affected Products: SAP HANA Extended Application Services (advanced model)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2771128'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0307
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.
Affected Products: SAP Solution Manager(Diagnostics Agent)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2772266'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0308
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.
Affected Products: SAP E-Commerce (Business-to-Consumer application)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2773493'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0311
Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP R/3 Enterprise Application
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2728153'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0312
Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings.
Affected Products: SAP NetWeaver Process Integration(SAP_XIESR)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2744086'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0314
SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Affected Products: SAP Work Manager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2793805'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0315
Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 and SAP_XIPCK 7.10 to 7.11, 7.20, 7.30) allows an attacker to access passwords used in FTP channels leading to information disclosure.
Affected Products: SAP NetWeaver Process Integration(SAP_XIESR)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2755438'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}]
CVE State: PUBLISHED
Explain CVE-2019-0316
SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.
Affected Products: SAP NetWeaver Process Integration(SAP_XIESR)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2745917'}]
CVE State: PUBLISHED
Explain CVE-2019-0318
Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted.
Affected Products: SAP NetWeaver Application Server for Java (Startup Framework)
References: [{'name': '109069', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109069'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2738791'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0319
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.
Affected Products: SAP Gateway
References: [{'name': '109074', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109074'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2752614'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}, {'tags': ['x_refsource_MISC'], 'url': 'https://cxsecurity.com/ascii/WLB-2019050283'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2911267'}]
CVE State: PUBLISHED
Explain CVE-2019-0321
ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: ABAP Server and ABAP Platform (SAP Basis)
References: [{'name': '109078', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109078'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2773888'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0322
SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Affected Products: SAP Commerce Cloud (ex SAP Hybris Commerce) (HY_COM)
References: [{'name': '109076', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109076'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2781873'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0325
SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.
Affected Products: SAP ERP HCM (SAP_HRCES) 
References: [{'name': '109075', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109075'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2798133'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0326
SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP BusinessObjects Business Intelligence Platform - BI Workspace (Enterprise)
References: [{'name': '109072', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109072'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2764733'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0327
SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.
Affected Products: SAP NetWeaver for Java Application Server - Web Container (engineapi) 
References: [{'name': '109071', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109071'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2777910'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0328
ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system.
Affected Products: SAP NetWeaver Process Integration ABAP tests (SAP Basis)
References: [{'name': '109067', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109067'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2774489'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0329
SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP Information Steward
References: [{'name': '109070', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109070'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2804833'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0330
The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Affected Products: SAP Diagnostic Agent (LM-Service)
References: [{'name': '109068', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109068'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2808158'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575'}]
CVE State: PUBLISHED
Explain CVE-2019-0331
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.
Affected Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2742468'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}]
CVE State: PUBLISHED
Explain CVE-2019-0332
SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.
Affected Products: SAP BusinessObjects Business Intelligence Platform (Info View)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2742468'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}]
CVE State: PUBLISHED
Explain CVE-2019-0333
In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.
Affected Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2764513'}]
CVE State: PUBLISHED
Explain CVE-2019-0334
When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.
Affected Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2771221'}]
CVE State: PUBLISHED
Explain CVE-2019-0335
Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack.
Affected Products: SAP BusinessObjects Business Intelligence Platform (CMC)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2742468'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}]
CVE State: PUBLISHED
Explain CVE-2019-0337
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability
Affected Products: SAP NetWeaver Process Integration (Java Proxy Runtime)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2789866'}]
CVE State: PUBLISHED
Explain CVE-2019-0338
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.
Affected Products: SAP Gateway
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2793351'}]
CVE State: PUBLISHED
Explain CVE-2019-0340
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
Affected Products: SAP Enable Now
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2794742'}]
CVE State: PUBLISHED
Explain CVE-2019-0341
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.
Affected Products: SAP Enable Now
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2794742'}]
CVE State: PUBLISHED
Explain CVE-2019-0343
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
Affected Products: SAP Commerce Cloud (Mediaconversion Extension)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2786035'}]
CVE State: PUBLISHED
Explain CVE-2019-0344
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Affected Products: SAP Commerce Cloud (virtualjdbc extension)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2786035'}]
CVE State: PUBLISHED
Explain CVE-2019-0345
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.
Affected Products: SAP NetWeaver Application Server for Java (Administrator System Overview)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2813811'}]
CVE State: PUBLISHED
Explain CVE-2019-0346
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.
Affected Products: SAP Business Objects Business Intelligence Platform (CMC)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2764513'}]
CVE State: PUBLISHED
Explain CVE-2019-0348
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
Affected Products: SAP Business Objects Business Intelligence Platform (Web Intelligence)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2751470'}]
CVE State: PUBLISHED
Explain CVE-2019-0349
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check
Affected Products: SAP Kernel (KRNL32NUC)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2798743'}]
CVE State: PUBLISHED
Explain CVE-2019-0350
SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service
Affected Products: SAP HANA Database
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.support.sap.com/#/notes/2798243'}]
CVE State: PUBLISHED