Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-0262 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.308Z Vendors: SAP SE Products: SAP WebIntelligence BILaunchPad (Enterprise) Problem Types: Cross-Site Scripting Description: SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - http://www.securityfocus.com/bid/106998 - https://launchpad.support.sap.com/#/notes/2696714
CVE ID: CVE-2019-0265 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.194Z Vendors: SAP SE Products: ABAP Platform (KRNL32NUC), ABAP Platform (KRNL32UC), ABAP Platform (KRNL64NUC), ABAP Platform (KRNL64UC), ABAP Platform (KERNEL) Problem Types: Denial of Service Description: SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73
, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - http://www.securityfocus.com/bid/106972 - https://launchpad.support.sap.com/#/notes/2729710 - http://www.securityfocus.com/bid/107364
CVE ID: CVE-2019-0266 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.422Z Vendors: SAP SE Products: SAP HANA Extended Application Services, advanced model (XS advanced) Problem Types: Information Disclosure Description: Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2724713 - https://wiki.scn.sap.com/wiki/p
CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2724713 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - http://www.securityfocus.com/bid/106988
CVE ID: CVE-2019-0267 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.407Z Vendors: SAP SE Products: SAP Manufacturing Integration and Intelligence Problem Types: Cross-Site Request Forgery Description: SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106990 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.
s.com/bid/106990 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2686535
CVE ID: CVE-2019-0268 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.566Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (CMC Module) Problem Types: Missing XML Validation Description: SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 - https://launchpad.support.sap.com/#/notes/2689259 - http://www.securityfocus.com/bid/107364
CVE ID: CVE-2019-0269 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.455Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2693962 - http://www.securityfocus.com/bid/107359 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080
CVE ID: CVE-2019-0270 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.340Z Vendors: SAP SE Products: ABAP Platform & Server (KRNL32NUC), ABAP Platform & Server (KRNL32UC), ABAP Platform & Server (KRNL64NUC), ABAP Platform & Server (KRNL64UC), ABAP Platform & Server (KERNEL) Problem Types: Missing Authorization Check Description: ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,
32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107377 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 - https://launchpad.support.sap.com/#/notes/2727689
CVE ID: CVE-2019-0271 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.313Z Vendors: SAP SE Products: ABAP Server, ABAP Server & Platform Problem Types: XML External Entity (XXE) Description: ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform. For more recent updates please refer to Security Note 2870067 (which supersedes the solution of Security Note 2736825) in the ref
recent updates please refer to Security Note 2870067 (which supersedes the solution of Security Note 2736825) in the reference section below. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107355 - https://launchpad.support.sap.com/#/notes/2870067 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2736825 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080
CVE ID: CVE-2019-0274 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.199Z Vendors: SAP SE Products: SAP Mobile Platform SDK Problem Types: Denial of Service Description: SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of service). Fixed in versions 3.1 SP03 PL02, SDK 3.1 SP04, or later. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107360 - https://launchpad.support.sap.com/#/notes/2753497 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080
CVE ID: CVE-2019-0275 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.521Z Vendors: SAP SE Products: SAP NetWeaver Java Application Server (J2EE-APPS) Problem Types: Cross-Site Scripting Description: SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 - https://launchpad.support.sap.com/#/notes/2689925 - http://www.securityfocus.c
/pages/viewpage.action?pageId=515408080 - https://launchpad.support.sap.com/#/notes/2689925 - http://www.securityfocus.com/bid/107362
CVE ID: CVE-2019-0276 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.230Z Vendors: SAP SE Products: Banking services from SAP 9.0 (FSAPPL), SAP S/4HANA Financial Products Subledger (S4FPSL) Problem Types: Missing Authorization Check Description: Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 - http://www.securityfocus.com/bid/107353 - https:
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 - http://www.securityfocus.com/bid/107353 - https://launchpad.support.sap.com/#/notes/2754235
CVE ID: CVE-2019-0277 State: PUBLISHED Published: 2019-03-12T22:00:00 Last Updated: 2024-08-04T17:44:16.319Z Vendors: SAP SE Products: SAP HANA Extended Application Services Problem Types: XML External Entity Description: SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability). Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2764283 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 - http://www.securityfocus.com/bid/107356
CVE ID: CVE-2019-0278 State: PUBLISHED Published: 2019-04-10T20:13:45 Last Updated: 2024-08-04T17:44:16.299Z Vendors: SAP SE Products: SAP NetWeaver Process Integration (Messaging System) Problem Types: Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure. Description: Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see t
ntegration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2741201 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114
CVE ID: CVE-2019-0279 State: PUBLISHED Published: 2019-04-10T20:17:27 Last Updated: 2024-08-04T17:44:16.179Z Vendors: SAP SE Products: SAP BASIS Problem Types: ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges. Description: ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do
, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 - https://launchpad.support.sap.com/#/notes/2753629
CVE ID: CVE-2019-0280 State: PUBLISHED Published: 2019-05-14T20:20:04 Last Updated: 2024-08-04T17:44:16.517Z Vendors: SAP SE Products: SAP Treasury and Risk Management(EA-FINSERV), SAP Enterprise Financial Services (S4CORE) Problem Types: Missing Authorization Check Description: SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2744937 - https://wiki.scn.sap.com/wiki/pages
Program Container: References: - https://launchpad.support.sap.com/#/notes/2744937 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032
CVE ID: CVE-2019-0281 State: PUBLISHED Published: 2019-07-10T18:46:17 Last Updated: 2024-08-04T17:44:16.570Z Vendors: SAP SE Products: OpenUI5, SAPUI5 Problem Types: Cross-Site Scripting Description: SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109077 - https://launchpad.support.sap.com/#/notes/2756539 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0282 State: PUBLISHED Published: 2019-04-10T20:19:41 Last Updated: 2024-08-04T17:44:16.560Z Vendors: SAP SE Products: SAP NetWeaver Process Integration (Runtime Workbench) Problem Types: Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker. Description: Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authenticatio
(Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 - https://launchpad.support.sap.com/#/notes/2742758
CVE ID: CVE-2019-0283 State: PUBLISHED Published: 2019-04-10T20:23:32 Last Updated: 2024-08-04T17:44:16.378Z Vendors: SAP SE Products: SAP NetWeaver Process Integration (Adapter Engine) Problem Types: Digital Signature Spoofing Description: SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document. Additional Analyst Notes: - CVE Program Con
altered, especially when the signed element is the body of the xml document. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 - https://launchpad.support.sap.com/#/notes/2747683
CVE ID: CVE-2019-0284 State: PUBLISHED Published: 2019-04-10T20:25:40 Last Updated: 2024-08-04T17:44:16.347Z Vendors: SAP SE Products: SAP HANA Problem Types: XML External Entity Description: SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 - https://launchpad.suppor
Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 - https://launchpad.support.sap.com/#/notes/2772376
CVE ID: CVE-2019-0285 State: PUBLISHED Published: 2019-04-10T20:26:59 Last Updated: 2024-08-04T17:44:16.353Z Vendors: SAP SE Products: SAP Crystal Reports for Visual Studio Problem Types: Information Disclosure Description: The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 - https://launchpad.support.sap.com/#/notes/2687663 - http://packetstormsecurity.com/files/153471/SAP-Crystal-Reports-Information-Disclosure.html
CVE ID: CVE-2019-0287 State: PUBLISHED Published: 2019-05-14T20:20:27 Last Updated: 2024-08-04T17:44:16.324Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence platform (Central Management Server) Problem Types: Information Disclosure Description: Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2737278 - http://www.securityfocus.com/bid/108316
CVE ID: CVE-2019-0289 State: PUBLISHED Published: 2019-05-14T20:20:44 Last Updated: 2024-08-04T17:44:16.424Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence platform Problem Types: Information Disclosure Description: Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2738796
CVE ID: CVE-2019-0291 State: PUBLISHED Published: 2019-05-14T20:21:14 Last Updated: 2024-08-04T17:44:16.377Z Vendors: SAP SE Products: SAP Solution Manager Problem Types: Information Disclosure Description: Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2748699 - http://www.securityfocus.com/bid/108313
CVE ID: CVE-2019-0293 State: PUBLISHED Published: 2019-05-14T20:21:40 Last Updated: 2024-08-04T17:44:16.414Z Vendors: SAP SE Products: SAP Solution Manager system (ST-PI) Problem Types: Missing Authorization Check Description: Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2756625 - http://www.secur
p.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2756625 - http://www.securityfocus.com/bid/108324
CVE ID: CVE-2019-0298 State: PUBLISHED Published: 2019-05-14T20:22:10 Last Updated: 2024-08-04T17:44:16.423Z Vendors: SAP SE Products: SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP) Problem Types: Cross-Site Scripting Description: SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259
Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2773086 - http://www.securityfocus.com/bid/108314
CVE ID: CVE-2019-0301 State: PUBLISHED Published: 2019-05-14T20:22:32 Last Updated: 2024-08-04T17:44:16.388Z Vendors: SAP SE Products: SAP Identity Management (REST Interface) Problem Types: Other Description: Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 - https://launchpad.support.sap.com/#/notes/2784307
CVE ID: CVE-2019-0303 State: PUBLISHED Published: 2019-06-14T18:50:18 Last Updated: 2024-08-04T17:44:16.390Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Administration Console) Problem Types: Cross Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
cessed. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 - https://launchpad.support.sap.com/#/notes/2637997
CVE ID: CVE-2019-0304 State: PUBLISHED Published: 2019-06-12T14:21:39 Last Updated: 2024-08-04T17:44:16.439Z Vendors: SAP SE Products: SAP NetWeaver AS ABAP Platform(KRNL32NUC), SAP NetWeaver AS ABAP Platform(KRNL32UC), SAP NetWeaver AS ABAP Platform(KRNL64NUC), SAP NetWeaver AS ABAP Platform(KRNL64UC), SAP NetWeaver AS ABAP Platform(KERNEL) Problem Types: Code Injection Description: FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or speci
.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2719530 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242