Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-2458 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:33.974Z Vendors: SAP Products: SAP Business One Problem Types: Information Disclosure Description: Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2670284 - http://www.securityfocus.com/bid/105307 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE ID: CVE-2018-2459 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:34.097Z Vendors: SAP Products: SAP Mobile Platform Problem Types: Information disclosure Description: Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a different user. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 - https://launchpad.support.sap.com/#/notes/2672919 - http://www.securityfocus.com/bid/105338
CVE ID: CVE-2018-2460 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:34.095Z Vendors: SAP Products: SAP Business One Android application Problem Types: Insecure Certificate Verification Description: SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 - http://www.securityfocus.com/bid/105309 - https://launchpad.support.sap.com/#/notes/2682503
CVE ID: CVE-2018-2461 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:34.532Z Vendors: SAP Products: GBX01 HR Problem Types: Missing Authorization Description: Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2673959 - http://www.securityfocus.com/bid/105327 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993
CVE ID: CVE-2018-2462 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:33.906Z Vendors: SAP Products: SAP NetWeaver BI Problem Types: XML Validation Description: In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2644279 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 - http://www.securityfocus.com/bid/105326
CVE ID: CVE-2018-2463 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:34.044Z Vendors: SAP Products: SAP Hybris Commerce Problem Types: Server-Side Request Forgery (SSRF) Description: The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105339 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 - https://launchpad.support.sap.com/#/notes/2680834
CVE ID: CVE-2018-2464 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:34.168Z Vendors: SAP Products: SAP WebDynpro Problem Types: Cross-Site Scripting Description: SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2679378 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 - http://www.securityfocus.com/bid/105308
CVE ID: CVE-2018-2465 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T04:21:33.819Z Vendors: SAP Products: SAP HANA Problem Types: Denial of Service Description: SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hacker can cause the database server to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105324 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 - https://launchpad.support.sap.com/#/notes/2681207
CVE ID: CVE-2018-2466 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:33.933Z Vendors: SAP Products: SAP Data Services Problem Types: Cross-Site Scripting Description: In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2618337 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - http://www.securityfocus.com/bid/105529
CVE ID: CVE-2018-2467 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:34.174Z Vendors: SAP Products: SAP BusinessObjects BI Platform Servers (Software Development Kit) Problem Types: Information Disclosure Description: In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web Browser such as Chrome the system returns an error with the path of the used application server. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - https://launchpad.support.sap.com/#/notes/2623618 - http://www.securityfocus.c
/pages/viewpage.action?pageId=500633095 - https://launchpad.support.sap.com/#/notes/2623618 - http://www.securityfocus.com/bid/105544
CVE ID: CVE-2018-2468 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:34.032Z Vendors: SAP Products: SAP Adaptive Server Enterprise (ASE) Problem Types: Information Disclosure Description: Under certain conditions the backup server in SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - http://www.securityfocus.com/bid/105527 - https://launchpad.support.sap.com/#/notes/2678615
CVE ID: CVE-2018-2469 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:33.621Z Vendors: SAP Products: SAP Adaptive Server Enterprise (ASE) Problem Types: Information Disclosure Description: Under certain conditions SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - https://launchpad.support.sap.com/#/notes/2679789 - http://www.securityfocus.com/bid/105526
CVE ID: CVE-2018-2470 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:34.206Z Vendors: SAP Products: SAP NetWeaver Application Server for ABAP Problem Types: Cross-Site Scripting Description: In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - https://launchpad.support.sap.com/#/notes/2684760 - http://www.securityfocus.com/bid/105551
CVE ID: CVE-2018-2471 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:34.150Z Vendors: SAP Products: SAP BusinessObjects Business Intelligence Platform Problem Types: Information Disclosure Description: Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2654905 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - http://www.securityfocus.com/bid/105530
CVE ID: CVE-2018-2472 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:34.514Z Vendors: SAP Products: SAP BusinessObjects Business Intelligence Platform Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 (Web Intelligence DHTML client) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - https://launchpad.support.sap.com/#/notes/2667103 - http://www.securityfocus.com/bid/105531
CVE ID: CVE-2018-2473 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.148Z Vendors: SAP Products: SAP BusinessObjects Business Intelligence Platform Server Problem Types: Denial of Service Description: SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2657670 - http://www.securityfocus.com/bid/105903 - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
port.sap.com/#/notes/2657670 - http://www.securityfocus.com/bid/105903 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2474 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:34.147Z Vendors: SAP Products: SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) Problem Types: Cross-Site Request Forgery Description: SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - http://www.securityfocus.com/bid/105534 - https://launchpad.support.sap.com/#/no
ages/viewpage.action?pageId=500633095 - http://www.securityfocus.com/bid/105534 - https://launchpad.support.sap.com/#/notes/2696889
CVE ID: CVE-2018-2475 State: PUBLISHED Published: 2018-10-09T13:00:00 Last Updated: 2024-08-05T04:21:33.648Z Vendors: SAP Products: project “Gardener” Problem Types: Missing network isolation Description: Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with other minor Kubernetes security issues, the missing network isolation theoretically can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the h
ally can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the high impact of a potential exploitation in "Gardener" context. This was fixed in Gardener release 0.12.4. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 - https://groups.google.com/forum/#%21topic/gardener/OjfKEe1LwXo - http://www.securityfocus.com/bid/105579 - https://launchpad.support.sap.com/#/notes/2699726
CVE ID: CVE-2018-2476 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.120Z Vendors: SAP Products: SAP NetWeaver (forums) Problem Types: URL Redirection Description: Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2658755 - http://www.securityfocus.com/bid/105898 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2477 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.098Z Vendors: SAP Products: Knowledge Management (XMLForms) in SAP NetWeaver Problem Types: Missing XML Validation Description: Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2661740 - http://www.securityfocus.com/bid/105901 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2478 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:33.607Z Vendors: SAP Products: SAP Basis (TREX / BWA installation) Problem Types: Other Description: An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands executed depend upon the privileges of the <sid>adm user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105904 - https://launchpad.support.sap.com/#/notes/267
Program Container: References: - http://www.securityfocus.com/bid/105904 - https://launchpad.support.sap.com/#/notes/2675696 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2479 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.148Z Vendors: SAP Products: SAP BusinessObjects Business Intelligence Platform (BIWorkspace) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105902 - https://launchpad.support.sap.com/#/notes/2676094 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2481 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.036Z Vendors: SAP Products: SAP_ABA Problem Types: Other Description: In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is used. By implementing such transaction code a malicious user may execute unauthorized transaction functionality. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105906 - https://launchpad.support.sap.com/#/notes/2693083 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2482 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.116Z Vendors: SAP Products: SAP Mobile Secure Android Application Problem Types: Denial of Service Description: SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Install the Mobile Secure Android client released in Mid-Oct 2018. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2695896 - http://www.securityfocus.com/bid/105900 - https://wiki.scn.sap.com/wiki/pages/vie
hpad.support.sap.com/#/notes/2695896 - http://www.securityfocus.com/bid/105900 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2483 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:33.909Z Vendors: SAP Products: SAP BusinessObjects Business Intelligence Platform Problem Types: Other Description: HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing request method. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105899 - https://launchpad.support.sap.com/#/notes/2647714 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2484 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-05T04:21:33.945Z Vendors: SAP SE Products: SAP Enterprise Financial Services (SAPSCORE), SAP Enterprise Financial Services (S4CORE), SAP Enterprise Financial Services (EA-FINSERV), SAP Enterprise Financial Services (Bank/CFM) Problem Types: Missing Authorization Check Description: SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst
orm necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2662687 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - http://www.securityfocus.com/bid/106477
CVE ID: CVE-2018-2485 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.103Z Vendors: SAP Products: SAP Fiori Client Problem Types: Code Injection Description: It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105911 - https://launchpad.support.sap.com/#/notes/2691126 - https://wiki.s
ferences: - http://www.securityfocus.com/bid/105911 - https://launchpad.support.sap.com/#/notes/2691126 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2486 State: PUBLISHED Published: 2018-12-11T23:00:00 Last Updated: 2024-08-05T04:21:33.893Z Vendors: SAP Products: SAP Marketing (UICUAN), SAP Marketing (SAPSCORE) Problem Types: Cross-Site Scripting Description: SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699 - http://www.securityfocus.com/bid/106171 - https://launchpad.support.sap.com/#/notes/2705204
CVE ID: CVE-2018-2487 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.082Z Vendors: SAP Products: SAP Disclosure Management Problem Types: Directory/Path Traversal Description: SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in specific use cases, files within this zip file can land in different locations than the originally intended extraction point. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105908 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 - https://launchpad.support.sap.com/#/notes/2701410
CVE ID: CVE-2018-2488 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.155Z Vendors: SAP Products: SAP Fiori Client Problem Types: Denial of Service Description: It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori Client and cause the application to crash. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2691126 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2489 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.150Z Vendors: SAP Products: SAP Fiori Client Problem Types: Missing Authorization Check Description: Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2691126 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2490 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:34.156Z Vendors: SAP Products: SAP Fiori Client Problem Types: Other Description: The broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2691126 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2491 State: PUBLISHED Published: 2018-11-13T20:00:00 Last Updated: 2024-08-05T04:21:33.921Z Vendors: SAP Products: SAP Fiori Client Problem Types: Code Injection Description: When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually run inside the built-in log viewer of the application in case user opens the viewer and taps on the hyperlink in the viewer. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version. Additional Analyst Notes: - CVE Program Container: References: - https
ese issues and users must update to that version. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2691126 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
CVE ID: CVE-2018-2492 State: PUBLISHED Published: 2018-12-11T23:00:00 Last Updated: 2024-08-05T04:21:34.186Z Vendors: SAP Products: SAP NetWeaver Application Server (Java Library) Problem Types: Missing XML Validation Description: SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699 - https://launchpad.support.sap.com/#/notes/2642680 - http://www.securityfocus.com/bid/106153