Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47554 State: PUBLISHED Published: 2024-10-03T11:32:48.936Z Last Updated: 2025-01-31T15:02:47.229Z Vendors: Apache Software Foundation Products: Apache Commons IO Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/6ozr91rr9cj5
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
CVE ID: CVE-2024-47555 State: PUBLISHED Published: 2024-10-07T17:43:38.811Z Last Updated: 2024-10-07T18:34:28.107Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-306 Description: Missing Authentication - User & System Configuration Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE ID: CVE-2024-47556 State: PUBLISHED Published: 2024-10-07T18:14:08.147Z Last Updated: 2024-10-07T18:36:00.696Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-22 Description: Pre-Auth RCE via Path Traversal Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE ID: CVE-2024-47557 State: PUBLISHED Published: 2024-10-07T18:17:54.820Z Last Updated: 2024-10-07T18:35:52.793Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-22 Description: Pre-Auth RCE via Path Traversal Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE ID: CVE-2024-47558 State: PUBLISHED Published: 2024-10-07T18:19:52.030Z Last Updated: 2024-10-07T18:35:46.142Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-22 Description: Authenticated RCE via Path Traversal Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE ID: CVE-2024-47559 State: PUBLISHED Published: 2024-10-07T18:21:39.723Z Last Updated: 2024-10-07T18:35:37.222Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Xerox Products: FreeFlow Core Problem Types: CWE-22 Description: Authenticated RCE via Path Traversal Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf
CVE ID: CVE-2024-47560 State: PUBLISHED Published: 2024-10-01T01:00:23.083Z Last Updated: 2024-10-01T14:13:05.394Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: J’s Communication Co., Ltd. Products: RevoWorks Cloud Client Problem Types: CWE-863 Description: RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox environment, it does not compromise the client's local environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox
cal environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox environment may be violated by tampering registry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jscom.jp/news-20240918/ - https://jvn.jp/en/jp/JVN39280069/
CVE ID: CVE-2024-47561 State: PUBLISHED Published: 2024-10-03T10:23:16.214Z Last Updated: 2024-10-21T08:51:22.972Z Vendors: Apache Software Foundation Products: Apache Avro Java SDK Problem Types: CWE-502 Description: Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
CVE ID: CVE-2024-47562 State: PUBLISHED Published: 2024-10-08T08:40:51.614Z Last Updated: 2024-10-08T16:36:39.580Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Siemens SINEC Security Monitor Problem Types: CWE-77 Description: A vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly neutralize special elements in user input to the ```ssmctl-client``` command. This could allow an authenticated, lowly privileged local attacker to execute privileged commands in the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
xecute privileged commands in the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-430425.html
CVE ID: CVE-2024-47563 State: PUBLISHED Published: 2024-10-08T08:40:52.852Z Last Updated: 2024-10-08T16:28:09.708Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Siemens SINEC Security Monitor Problem Types: CWE-22 Description: A vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate a file path that is supplied to an endpoint intended to create CSR files. This could allow an unauthenticated remote attacker to create files in writable directories outside the intended location and thus compromise integrity of files in those writable direc
les in writable directories outside the intended location and thus compromise integrity of files in those writable directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-430425.html
CVE ID: CVE-2024-47565 State: PUBLISHED Published: 2024-10-08T08:40:54.092Z Last Updated: 2024-10-08T16:19:15.320Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Siemens SINEC Security Monitor Problem Types: CWE-183 Description: A vulnerability has been identified in Siemens SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate that user input complies with a list of allowed values. This could allow an authenticated remote attacker to compromise the integrity of the configuration of the affected application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
the configuration of the affected application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-430425.html
CVE ID: CVE-2024-47566 State: PUBLISHED Published: 2025-01-14T14:09:35.726Z Last Updated: 2025-01-14T20:54:34.253Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiRecorder Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory ('path traversal') [CWE-23] in Fortinet FortiRecorder version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-401
CVE ID: CVE-2024-47569 State: PUBLISHED Published: 2025-10-14T15:23:03.965Z Last Updated: 2025-10-16T15:31:53.740Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiVoice, FortiManager, FortiRecorder, FortiOS, FortiNDR, FortiPAM, FortiTester, FortiMail, FortiWeb, FortiProxy Problem Types: CWE-201 Description: A insertion of sensitive information into sent data in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiVoice 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.7 through 6.0.12, FortiMail 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.9, FortiOS 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 thro
ugh 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.9, FortiOS 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, 6.2.0 through 6.2.17, 6.0.0 through 6.0.18, FortiWeb 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.11, 7.0.0 through 7.0.11, 6.4.0 through 6.4.3, FortiRecorder 7.2.0 through 7.2.1, 7.0.0 through 7.0.4, FortiNDR 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.5, 7.1.0 through 7.1.1, 7.0.0 through 7.0.7, 1.5.0 through 1.5.3, FortiPAM 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiTester 7.4.0 through 7.4.2, 7.3.0 through 7.3.2, 7.2.0 through 7.2.3, 7.1.0 through 7.1.1, 7.0.0, 4.2.0 through 4.2.1, FortiP
r 7.4.0 through 7.4.2, 7.3.0 through 7.3.2, 7.2.0 through 7.2.3, 7.1.0 through 7.1.1, 7.0.0, 4.2.0 through 4.2.1, FortiProxy 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.21, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager 7.6.0 through 7.6.1, 7.4.1 through 7.4.3 allows attacker to disclose sensitive information via specially crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-228
CVE ID: CVE-2024-47571 State: PUBLISHED Published: 2025-01-14T14:10:00.156Z Last Updated: 2025-02-18T21:36:03.768Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-672 Description: An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-239
CVE ID: CVE-2024-47572 State: PUBLISHED Published: 2025-01-14T14:09:59.359Z Last Updated: 2025-02-18T21:36:45.163Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-1236 Description: An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-210
CVE ID: CVE-2024-47573 State: PUBLISHED Published: 2025-03-14T15:04:55.721Z Last Updated: 2025-03-14T17:53:27.052Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiNDR Problem Types: CWE-354 Description: An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, version 7.1.1 and below, version 7.0.6 and below may allow an authenticated attacker with at least Read/Write permission on system maintenance to install a corrupted firmware image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23
e image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-461
CVE ID: CVE-2024-47574 State: PUBLISHED Published: 2024-11-13T11:15:04.046Z Last Updated: 2024-11-13T14:43:08.240Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-288 Description: A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-199
CVE ID: CVE-2024-47575 State: PUBLISHED Published: 2024-10-23T15:03:48.798Z Last Updated: 2025-10-21T22:55:42.072Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-306 Description: A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows
nager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-423
CVE ID: CVE-2024-47576 State: PUBLISHED Published: 2024-12-10T00:11:43.031Z Last Updated: 2024-12-10T17:14:29.533Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Product Lifecycle Costing Problem Types: CWE-427 Description: SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Product Lifecycle Costing Client application. That particular DLL could be replaced by a malicious one, that could execute commands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low imp
mmands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low impact to confidentiality but no impact to the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3504847 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47577 State: PUBLISHED Published: 2024-12-10T00:11:49.563Z Last Updated: 2024-12-10T17:14:39.791Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Commerce Cloud Problem Types: CWE-319 Description: Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating as authorized admin visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is
in visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is extremely limited, and the attacker has no control over what data is leaked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3535451 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47578 State: PUBLISHED Published: 2024-12-10T00:11:57.435Z Last Updated: 2024-12-10T17:15:02.722Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver AS for JAVA (Adobe Document Services) Problem Types: CWE-918 Description: Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file
ng in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3536965 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47579 State: PUBLISHED Published: 2024-12-10T00:12:05.039Z Last Updated: 2024-12-16T19:16:35.048Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS for JAVA (Adobe Document Services) Problem Types: CWE-538 Description: An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability Additional Anal
that file allows the attacker to read any file on the server with no effect on integrity or availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3536965 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47580 State: PUBLISHED Published: 2024-12-10T00:12:11.655Z Last Updated: 2024-12-16T19:16:09.928Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS for JAVA (Adobe Document Services) Problem Types: CWE-538 Description: An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/no
ect on integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3536965 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47581 State: PUBLISHED Published: 2024-12-10T00:12:17.567Z Last Updated: 2024-12-10T15:37:24.770Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP HCM Problem Types: CWE-862 Description: SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3522332 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47582 State: PUBLISHED Published: 2024-12-10T00:12:24.270Z Last Updated: 2024-12-10T20:38:26.239Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP_SE Products: SAP NetWeaver AS JAVA Problem Types: CWE-611 Description: Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3351041 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47585 State: PUBLISHED Published: 2024-12-10T00:12:29.987Z Last Updated: 2024-12-10T21:28:59.358Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-862 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitat
distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitation, this can result in potential security concerns. However, it has no impact on the integrity and availability of the application and may have only a low impact on data confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3536361 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47586 State: PUBLISHED Published: 2024-11-12T00:25:56.315Z Last Updated: 2024-11-12T17:14:50.589Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-476 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity. Additional Analyst Note
ng the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3504390 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47587 State: PUBLISHED Published: 2024-11-12T00:26:04.301Z Last Updated: 2024-11-12T20:13:43.488Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Cash Management (Cash Operations) Problem Types: CWE-862 Description: Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3498470 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-47588 State: PUBLISHED Published: 2024-11-12T00:26:10.765Z Last Updated: 2024-11-12T20:13:33.683Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Java (Software Update Manager) Problem Types: CWE-522 Description: In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability. Additio
ials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3522953 - https://url.sap/sapsecuritypatchday