Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-33663 State: PUBLISHED Published: 2021-06-09T13:33:06 Last Updated: 2024-08-03T23:58:22.262Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS ABAP Problem Types: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Description: SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83,7.84, allows an unauthorized attacker to insert cleartext commands due to improper restriction of I/O buffering into encrypted
llows an unauthorized attacker to insert cleartext commands due to improper restriction of I/O buffering into encrypted SMTP sessions over the network which can partially impact the integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3030604
CVE ID: CVE-2021-33664 State: PUBLISHED Published: 2021-06-09T13:32:50 Last Updated: 2024-08-03T23:58:22.366Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP) Problem Types: Cross Site Scripting Description: SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.actio
ity. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3025604
CVE ID: CVE-2021-33665 State: PUBLISHED Published: 2021-06-09T13:33:13 Last Updated: 2024-08-03T23:58:21.921Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Problem Types: Cross Site Scripting Description: SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com
Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3028370
CVE ID: CVE-2021-33666 State: PUBLISHED Published: 2021-06-09T13:32:45 Last Updated: 2024-08-03T23:58:22.397Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Commerce Cloud Problem Types: Cross-Site Scripting Description: When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/2985562
CVE ID: CVE-2021-33667 State: PUBLISHED Published: 2021-07-14T11:03:26 Last Updated: 2024-08-03T23:58:21.924Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Business Objects Web Intelligence (BI Launchpad) Problem Types: Improper Input Validation Description: Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3044751
cted. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3044751 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506
CVE ID: CVE-2021-33668 State: PUBLISHED Published: 2021-06-09T12:02:26 Last Updated: 2024-08-03T23:58:22.420Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP InfraBox Problem Types: LDAP Injection Description: Due to improper input sanitization, specially crafted LDAP queries can be injected by an unauthenticated user. This could partially impact the confidentiality of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SAP/scimono/security/advisories/GHSA-wg9g-w4fg-3qqc
CVE ID: CVE-2021-33669 State: PUBLISHED Published: 2021-06-09T13:59:32 Last Updated: 2024-08-03T23:58:22.133Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Mobile SDK Certificate Provider Problem Types: Insecure Temporary File Storage Description: Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a successful exploitation user interaction from another user is required and could lead to complete impact of confidentiality integrity and availability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SAP/mobil
ntegrity and availability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SAP/mobilesdk-certificateprovider/security/advisories/GHSA-r2j9-h6q9-cq8g
CVE ID: CVE-2021-33670 State: PUBLISHED Published: 2021-07-14T11:04:11 Last Updated: 2024-08-03T23:58:22.541Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver AS for Java (Http Service) Problem Types: Denial of Service Description: SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to denial of service vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.
ading to denial of service vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3056652 - http://seclists.org/fulldisclosure/2022/May/4 - http://packetstormsecurity.com/files/166965/SAP-NetWeaver-Java-Denial-Of-Service.html
CVE ID: CVE-2021-33671 State: PUBLISHED Published: 2021-07-14T11:03:32 Last Updated: 2024-08-03T23:58:22.066Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: SAP SE Products: SAP NetWeaver Guided Procedures (Administration Workset) Problem Types: Missing Authorization Check Description: SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. The impact of missing authorization could result to abuse of functionality restricted to a particular user group, and could allow unauthorized users to read, mod
result to abuse of functionality restricted to a particular user group, and could allow unauthorized users to read, modify or delete restricted data. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3059446 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506
CVE ID: CVE-2021-33672 State: PUBLISHED Published: 2021-09-14T11:21:48 Last Updated: 2024-08-03T23:58:22.864Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: SAP SE Products: SAP Contact Center Problem Types: OS Command Injection Description: Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete com
ker can further execute operating system level commands in the chat recipient's scope. This could lead to a complete compromise of their confidentiality, integrity, and could temporarily impact their availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3073891
CVE ID: CVE-2021-33673 State: PUBLISHED Published: 2021-09-14T11:18:51 Last Updated: 2024-08-03T23:58:22.552Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L) Vendors: SAP SE Products: SAP Contact Center Problem Types: OS Command Injection Description: Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to exploit a Stored Cross-Site Scripting (XSS) vulnerability when a user browses through the employee directory and to execute arbitrary code on the victim's browser. Due to the usage of ActiveX in the application, the attacker can further execute operating system lev
victim's browser. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3073891
CVE ID: CVE-2021-33674 State: PUBLISHED Published: 2021-09-14T11:24:33 Last Updated: 2024-08-03T23:58:22.396Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SAP SE Products: SAP Contact Center Problem Types: Cross-Site Scripting Description: Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected Cross-Site Scripting (XSS) vulnerability when creating a new email and to execute arbitrary code on the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https
tes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3073891
CVE ID: CVE-2021-33675 State: PUBLISHED Published: 2021-09-14T11:19:23 Last Updated: 2024-08-03T23:58:22.952Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Contact Center Problem Types: Cross-Site Scripting Description: Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected Cross-Site Scripting (XSS) vulnerability through phishing and to execute arbitrary code on the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launch
E Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3073891
CVE ID: CVE-2021-33676 State: PUBLISHED Published: 2021-07-14T11:03:48 Last Updated: 2024-08-03T23:58:22.363Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP CRM Problem Types: Missing Authority Check Description: A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3066316
CVE ID: CVE-2021-33677 State: PUBLISHED Published: 2021-07-14T11:03:57 Last Updated: 2024-08-03T23:58:22.565Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: Information Disclosure Description: SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3044754
CVE ID: CVE-2021-33678 State: PUBLISHED Published: 2021-07-14T11:04:19 Last Updated: 2024-08-03T23:58:22.357Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver AS ABAP (Reconciliation Framework) Problem Types: CWE-95 Description: A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable. Additional Analyst Notes: - CVE
delete some critical information and could make the SAP system completely unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3048657 - http://seclists.org/fulldisclosure/2022/May/42 - http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
CVE ID: CVE-2021-33679 State: PUBLISHED Published: 2021-09-14T11:19:15 Last Updated: 2024-08-03T23:58:22.807Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace) Problem Types: Cross-Site Scripting Description: The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a new module document, file, or folder. When another user visits that page, the stored malicious script will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity. Additio
pt will execute in their session, hence allowing the attacker to compromise their confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3055180
CVE ID: CVE-2021-33680 State: PUBLISHED Published: 2021-07-14T11:03:39 Last Updated: 2024-08-03T23:58:22.423Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-120 Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and causes the application to crash and becoming temporarily unavailable until the user restarts the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.suppo
Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3067890
CVE ID: CVE-2021-33681 State: PUBLISHED Published: 2021-07-14T11:04:04 Last Updated: 2024-08-03T23:58:22.296Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-787 Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and causes the application to crash and becoming temporarily unavailable until the user restarts the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.s
gram Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3067890
CVE ID: CVE-2021-33682 State: PUBLISHED Published: 2021-07-14T11:08:58 Last Updated: 2024-08-03T23:58:22.821Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Lumira Server Problem Types: Cross-Site Scripting Description: SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with basic level privileges to store a malicious script on SAP Lumira Server. The execution of the script content, by a victim registered on SAP Lumira Server, could compromise the confidentiality and integrity of SAP Lumira content. Additional Analyst Note
on SAP Lumira Server, could compromise the confidentiality and integrity of SAP Lumira content. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3053403
CVE ID: CVE-2021-33683 State: PUBLISHED Published: 2021-07-14T11:04:45 Last Updated: 2024-08-03T23:58:22.780Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Web Dispatcher and Internet Communication Manager Problem Types: CWE-444 Description: SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect
.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3000663
CVE ID: CVE-2021-33684 State: PUBLISHED Published: 2021-07-14T11:04:32 Last Updated: 2024-08-03T23:58:22.539Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: CWE-787 Description: SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work
7.81, 7.84, allows an attacker to send overlong content in the RFC request type thereby crashing the corresponding work process because of memory corruption vulnerability. The work process will attempt to restart itself after the crash and hence the impact on the availability is low. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3032624
CVE ID: CVE-2021-33685 State: PUBLISHED Published: 2021-09-14T11:21:56 Last Updated: 2024-08-03T23:58:22.577Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Business One Problem Types: Directory/Path Traversal Description: SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restricted directory. A successful attack allows access to high level sensitive data Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/306903
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3069032
CVE ID: CVE-2021-33686 State: PUBLISHED Published: 2021-09-14T11:24:43 Last Updated: 2024-08-03T23:58:22.491Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Business One Problem Types: Information Disclosure Description: Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over kind or degree. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3070138
CVE ID: CVE-2021-33687 State: PUBLISHED Published: 2021-07-14T11:05:00 Last Updated: 2024-08-03T23:58:22.359Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (Enterprise Portal) Problem Types: Information Disclosure Description: SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launch
E Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3059764 - http://seclists.org/fulldisclosure/2021/Oct/32 - http://packetstormsecurity.com/files/164600/SAP-Enterprise-Portal-Sensitive-Data-Disclosure.html
CVE ID: CVE-2021-33688 State: PUBLISHED Published: 2021-09-14T11:24:52 Last Updated: 2024-08-03T23:58:22.357Z Vendors: SAP SE Products: SAP Business One Problem Types: SQL Injection Description: SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions, only some information can be obtained. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - https://launchpad.support.sap.com/#/notes/3069882
CVE ID: CVE-2021-33689 State: PUBLISHED Published: 2021-07-14T11:04:38 Last Updated: 2024-08-03T23:58:22.613Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (Administrator applications) Problem Types: CWE-778 Description: When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/
eferences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - https://launchpad.support.sap.com/#/notes/3038594