Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-2383 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.695Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Reflected Cross-Site Scripting Description: Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2384 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.820Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Denial-of-Service Description: Under certain conditions a malicious user provoking a Null Pointer dereference can prevent legitimate users from accessing the SAP Internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, and its services. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2385 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.729Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Denial-of-Service Description: Under certain conditions a malicious user provoking a divide by zero crash can prevent legitimate users from accessing the SAP Internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, and its services. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2386 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.755Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Denial-of-Service Description: Under certain conditions a malicious user provoking an out of bounds buffer overflow can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2387 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.818Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Information Disclosure Description: A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on ports, which is not available to the user otherwise. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2388 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.834Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Cross-site Scripting Description: Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2389 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.771Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Log Injection Description: Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important information in the log file. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2390 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2391 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS portwatcher service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2392 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:14:39.801Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Missing XML Validation Description: Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2393 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:21:32.848Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Missing XML Validation Description: Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2394 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:21:32.936Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Denial-of-Service Description: Under certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, services and/or system files. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2395 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:21:33.202Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Unrestricted File Upload Description: Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, overwrite existing image or corrupt other type of files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103019 - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2396 State: PUBLISHED Published: 2018-02-14T12:00:00 Last Updated: 2024-08-05T04:21:32.937Z Vendors: SAP SE Products: SAP Internet Graphics Server Problem Types: Denial-of-Service Description: Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, using IGS Interpreter service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2525222 - https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
CVE ID: CVE-2018-2397 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T04:21:32.881Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: Cross-Site Scripting (XSS) Description: In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which results in Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - https://launchpad.support.sap.com/#/notes/
nces: - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - https://launchpad.support.sap.com/#/notes/2550538 - http://www.securityfocus.com/bid/103373
CVE ID: CVE-2018-2398 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T04:21:32.877Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: SAP SE Products: SAP Business Client Problem Types: Information Disclosure Description: Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - https://launchpad.support.sap.com/#/notes/2580967 - http://www.securityfocus.com/bid/103370
CVE ID: CVE-2018-2399 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T04:21:32.854Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Process Monitoring Infrastructure Problem Types: Cross-Site Scripting Description: Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103372 - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - https://launchpad.support.sap.com/#/notes/2592807
CVE ID: CVE-2018-2400 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T04:21:32.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2596535 - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - http://www.securityfocus.com/bid/103375
CVE ID: CVE-2018-2401 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T04:21:32.880Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP SE Products: SAP Business Process Automation (BPA) By Redwood Problem Types: XML External Entity Description: SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2596766 - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - http://www.securityfo
rt.sap.com/#/notes/2596766 - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - http://www.securityfocus.com/bid/103374
CVE ID: CVE-2018-2402 State: PUBLISHED Published: 2018-03-14T19:00:00 Last Updated: 2024-08-05T04:21:33.207Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP HANA Problem Types: Information Disclosure Description: In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target syste
l system may be able to access the user credentials and gain unauthorized access to data in the captured or target system. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018/ - http://www.securityfocus.com/bid/103369 - https://launchpad.support.sap.com/#/notes/2587369
CVE ID: CVE-2018-2403 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:33.236Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Information Disclosure Description: Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an authorized user to get SAP Disclosure Management to point a specific chapter type to a chapter the user has not been given access to. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2595800 - https:/
tional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2595800 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - http://www.securityfocus.com/bid/103727
CVE ID: CVE-2018-2404 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:32.849Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Unrestricted File Upload Description: SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2607052 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - http://www.securityfocus.com/bid/103727
CVE ID: CVE-2018-2405 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:33.244Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Solution Manager Problem Types: Cross-Site Scripting Description: SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103703 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - https://launchpad.support.sap.com/#/notes/2372688
CVE ID: CVE-2018-2406 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:33.203Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP Crystal Reports Server, OEM Edition Problem Types: Directory/Path Traversal Description: Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2560132 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - http://www.securityfocus.com/bid/103719
CVE ID: CVE-2018-2408 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:32.886Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP Business Objects Problem Types: Other Description: Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - https://launchpad.support.sap.com/#/notes/2537150 - http://
logs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - https://launchpad.support.sap.com/#/notes/2537150 - http://www.securityfocus.com/bid/103700
CVE ID: CVE-2018-2409 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:33.273Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP Cloud Platform Connector Problem Types: Other Description: Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103702 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - https://l
ttp://www.securityfocus.com/bid/103702 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - https://launchpad.support.sap.com/#/notes/2614141
CVE ID: CVE-2018-2410 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:33.202Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business One Problem Types: Cross-Site Scripting Description: SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103704 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - https://launchpad.support.sap.com/#/notes/2582870
CVE ID: CVE-2018-2412 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:32.877Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Missing Authorization Check Description: SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - http://www.securityfocus.com/bid/103727 - https://launchpad.support.sap.com/#/notes/2614359
CVE ID: CVE-2018-2413 State: PUBLISHED Published: 2018-04-10T15:00:00 Last Updated: 2024-08-05T04:21:33.914Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Missing Authorization Check Description: SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2614501 - https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/ - http://www.securityfocus.com/bid/103727
CVE ID: CVE-2018-2415 State: PUBLISHED Published: 2018-05-09T20:00:00 Last Updated: 2024-08-05T04:21:33.263Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver Application Server (Engine API), SAP NetWeaver Application Server (J2EE Engine Server Core) Problem Types: Content Spoofing Description: SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed. Additional Analyst Notes: - CVE P
inputs, resulting in a content spoofing vulnerability when error pages are displayed. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/ - https://launchpad.support.sap.com/#/notes/2550202 - http://www.securityfocus.com/bid/104130
CVE ID: CVE-2018-2416 State: PUBLISHED Published: 2018-05-09T20:00:00 Last Updated: 2024-08-05T04:21:33.228Z Vendors: SAP Products: SAP Identity Management Problem Types: Missing XML Validation Description: SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105076 - http://www.securityfocus.com/bid/104106 - https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/ - https://launchpad.support.sap.com/#/notes/2597875 - https://launchpad.support.sap.com/#/notes/2653519 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?page
s/2597875 - https://launchpad.support.sap.com/#/notes/2653519 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499352742
CVE ID: CVE-2018-2417 State: PUBLISHED Published: 2018-05-09T20:00:00 Last Updated: 2024-08-05T04:21:33.233Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Identity Management Problem Types: Information Disclosure Description: Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/ - http://www.securityfocus.com/bid/104112 - https://launchpad.support.sap.com/#/notes/2601492
CVE ID: CVE-2018-2418 State: PUBLISHED Published: 2018-05-09T20:00:00 Last Updated: 2024-08-05T04:21:33.280Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: SAP SE Products: SAP MaxDB ODBC driver Problem Types: Code Injection Description: SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/ - https://launchpad.support.sap.com/#/notes/2610231 - http://www.securityfocus.com/bid/104115
CVE ID: CVE-2018-2419 State: PUBLISHED Published: 2018-05-09T20:00:00 Last Updated: 2024-08-05T04:21:33.627Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Enterprise Financial Services (SAPSCORE), SAP Enterprise Financial Services (S4CORE), SAP Enterprise Financial Services (EA-FINSERV) Problem Types: Missing Authorization Check Description: SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References
authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/ - http://www.securityfocus.com/bid/104116 - https://launchpad.support.sap.com/#/notes/2596627
CVE ID: CVE-2018-2420 State: PUBLISHED Published: 2018-05-09T20:00:00 Last Updated: 2024-08-05T04:21:33.262Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: SAP SE Products: SAP Internet Graphics Server (IGS) Problem Types: Unrestricted File Upload Description: SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format validation. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2615635 - https://blogs.sap.com/2018/05/08/sap-security-patch-day-may-2018/ - http://www.securityfocus.com/bid/104108