Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ics, AMD Ryzen™ Embedded 7000 Series Processors, AMD Ryzen™ Embedded 8000 Series Processors, AMD Radeon™ RX 5000 Series Graphics Products, AMD Radeon™ PRO W5000 Series Graphics Products, AMD Radeon™ RX 6000 Series Graphics Products, AMD Radeon™ PRO W6000 Series Graphics Products, AMD Radeon™ RX 7000 Series Graphics Products, AMD Radeon™ PRO W7000 Series Graphics Products, AMD Radeon™ PRO V520 Graphics Products, AMD Radeon™ PRO V620 Graphics Products, AMD Radeon™ PRO V710 Graphics Products Problem Types: CWE-476 Description: A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss of availabi
ould allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE ID: CVE-2025-0010 State: PUBLISHED Published: 2025-09-06T18:26:15.118Z Last Updated: 2025-09-08T19:56:43.287Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: AMD Products: AMD Radeon™ RX 5000 Series Graphics Products, AMD Radeon™ RX 6000 Series Graphics Products, AMD Radeon™ RX 7000 Series Graphics Products, AMD Radeon™ RX Vega Series Graphics Cards, AMD Radeon™ PRO W5000 Series Graphics Products, AMD Radeon™ PRO W6000 Series Graphics Products, AMD Radeon™ PRO W7000 Series Graphics Products, AMD Radeon™ VII, AMD Instinct™ MI200, AMD Instinct™ MI210, AMD Instinct™ MI250, AMD Instinct™ MI300A, AMD Instinct™ MI300X, AMD Radeon™ PRO V520 Graphics Products, A
tinct™ MI210, AMD Instinct™ MI250, AMD Instinct™ MI300A, AMD Instinct™ MI300X, AMD Radeon™ PRO V520 Graphics Products, AMD Radeon™ PRO V620 Graphics Products, AMD Radeon™ PRO V710 Graphics Products, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Desktop Processors, AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ AI 300 Serie
7000 Series Desktop Processors, AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ AI 300 Series Processors, AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 8000 Series Desktop Processors, AMD Ryzen™ 9000 Series Desktop Processors, AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Desktop Processors, AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 5000 Series Desktop Processors, AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics Problem Types:
Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics Problem Types: CWE-787 Description: An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity, or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE ID: CVE-2025-0011 State: PUBLISHED Published: 2025-09-06T18:29:38.832Z Last Updated: 2025-09-08T19:56:22.591Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: AMD Products: AMD Ryzen™ 8000 Series Desktop Processors, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Mobile Processors, AMD Ryzen™ Z1 Series Processors, AMD Ryzen™ Embedded 7000 Series Processors, AMD Ryzen™ Embedded V2000 Series Processors, AMD Ryzen™ Embedded 8000 Series Processors, AMD Radeo
00 Series Processors, AMD Ryzen™ Embedded V2000 Series Processors, AMD Ryzen™ Embedded 8000 Series Processors, AMD Radeon™ RX 5000 Series Graphics Products, AMD Radeon™ PRO W5000 Series Graphics Products, AMD Radeon™ RX 6000 Series Graphics Products, AMD Radeon™ PRO W6000 Series Graphics Products, AMD Radeon™ RX 7000 Series Graphics Products, AMD Radeon™ PRO W7000 Series Graphics Products, AMD Radeon™ PRO V520 Graphics Products, AMD Radeon™ PRO V620 Graphics Products, AMD Radeon™ PRO V710 Graphics Products Problem Types: CWE-212 Description: Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information
formation before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE ID: CVE-2025-0014 State: PUBLISHED Published: 2025-04-02T16:14:00.258Z Last Updated: 2025-04-24T03:55:29.660Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AMD Products: AMD Ryzen™ AI Software Problem Types: CWE-276 Description: Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7037.html
CVE ID: CVE-2025-0015 State: PUBLISHED Published: 2025-02-03T10:21:12.696Z Last Updated: 2025-02-03T15:49:50.132Z Vendors: Arm Ltd Products: Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to make improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0. Additional Analy
r52p0; Arm 5th Gen GPU Architecture Kernel Driver: from r48p0 through r49p1, from r50p0 through r52p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2025-0020 State: REJECTED Published: 2025-05-14T07:54:57.843Z Last Updated: 2025-05-19T19:07:02.724Z Description: No description available.
CVE ID: CVE-2025-0032 State: PUBLISHED Published: 2025-09-06T18:34:33.606Z Last Updated: 2025-09-09T03:55:25.811Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: AMD Products: AMD EPYC™ 9005 Series Processors, AMD Ryzen™ AI 300 Series Processors, AMD Ryzen™ 9000 Series Desktop Processors, AMD Ryzen™ 9000HX Series Processors, AMD Ryzen™ Al Max+, AMD Ryzen™ Threadripper™ 9000 series, AMD EPYC™ Embedded 9000 Series Processors Problem Types: CWE-459 Description: Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction
l administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html
CVE ID: CVE-2025-0033 State: PUBLISHED Published: 2025-10-14T14:49:03.633Z Last Updated: 2025-10-14T19:10:33.818Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: AMD Products: AMD EPYC™ 7003 Series Processors (formerly codenamed "Milan"), AMD EPYC™ 9005 Series Processors (formerly codenamed "Turin") Problem Types: CWE-284 Description: Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-30
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3020.html
CVE ID: CVE-2025-0034 State: PUBLISHED Published: 2025-09-06T18:35:44.023Z Last Updated: 2025-09-08T14:35:31.627Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: AMD Products: AMD Instinct™ MI300X, AMD Instinct™ MI325X Problem Types: CWE-787 Description: Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE ID: CVE-2025-0035 State: PUBLISHED Published: 2025-05-13T17:06:57.397Z Last Updated: 2025-05-16T03:55:44.321Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AMD Products: AMD Cloud Manageability Service Problem Types: CWE-428 Description: Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9015.html
CVE ID: CVE-2025-0036 State: PUBLISHED Published: 2025-06-09T23:57:39.748Z Last Updated: 2025-06-30T14:48:59.255Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: AMD Products: Versal Adaptive SoC Devices, Versal RF Series, Versal AI Edge Series, Versal Prime Series, Versal Premium Series, Versal AI Core Series, Versal HBM Series, Alveo V80 Compute Accelerator Problem Types: CWE-682, CWE-772, CWE-940, CWE-941, CWE-497 Description: In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrectly written to and read from invalid locations as well as returning incorrect
operations could cause data to be incorrectly written to and read from invalid locations as well as returning incorrect cryptographic data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8011.html
CVE ID: CVE-2025-0037 State: PUBLISHED Published: 2025-06-09T23:52:33.688Z Last Updated: 2025-06-10T15:27:52.107Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: AMD Products: Platform Loader and Manager (PLM) Problem Types: CWE-20 Description: In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow access to isolated or protected memory spaces, resulting in the loss of integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html
CVE ID: CVE-2025-0038 State: PUBLISHED Published: 2025-10-06T16:08:59.227Z Last Updated: 2025-10-06T17:16:22.921Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: AMD Products: Kria(TM) SOM, Zynq UltraScale+ MPSoCs, Zynq UltraScale+ RFSoCs Problem Types: CWE-1284 Description: In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the loss of integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8008.html
CVE ID: CVE-2025-0049 State: PUBLISHED Published: 2025-04-28T20:55:06.256Z Last Updated: 2025-04-28T22:28:10.671Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Fortra Products: GoAnywhere Problem Types: CWE-209 Description: When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2025-004
CVE ID: CVE-2025-0050 State: PUBLISHED Published: 2025-04-07T12:02:02.367Z Last Updated: 2025-04-10T14:06:48.933Z Vendors: Arm Ltd Products: Valhall GPU Userspace Driver, Arm 5th Gen GPU Architecture Userspace Driver, Bifrost GPU Userspace Driver Problem Types: CWE-119 Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations, including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Usersp
including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r0p0 through r49p2, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r19p0 through r49p2, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p2, from r50p0 through r53p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/110435/latest/
CVE ID: CVE-2025-0051 State: PUBLISHED Published: 2025-06-10T17:29:43.451Z Last Updated: 2025-06-11T14:42:30.846Z Vendors: Pure Storage Products: FlashArray Problem Types: CWE-20 Description: Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html
CVE ID: CVE-2025-0052 State: PUBLISHED Published: 2025-06-10T17:39:21.299Z Last Updated: 2025-06-11T14:41:02.200Z Vendors: Pure Storage Products: FlashBlade Problem Types: CWE-20 Description: Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html
CVE ID: CVE-2025-0053 State: PUBLISHED Published: 2025-01-14T00:08:21.600Z Last Updated: 2025-01-14T15:01:44.276Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-209 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits. Additional An
on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3536461 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0054 State: PUBLISHED Published: 2025-02-11T00:32:57.017Z Last Updated: 2025-02-18T18:08:26.569Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server Java Problem Types: CWE-79 Description: SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page. Addit
owser. With this the attacker might be able to read or modify information associated with the vulnerable web page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3526203 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0055 State: PUBLISHED Published: 2025-01-14T00:08:31.394Z Last Updated: 2025-01-14T15:02:06.169Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP GUI for Windows Problem Types: CWE-497 Description: SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of
he disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3472837 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0056 State: PUBLISHED Published: 2025-01-14T00:08:42.677Z Last Updated: 2025-01-14T15:01:22.073Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP GUI for Java Problem Types: CWE-497 Description: SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application. Additional Analyst Note
itical data to highly sensitive data, causing high impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3502459 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0057 State: PUBLISHED Published: 2025-01-14T00:08:50.916Z Last Updated: 2025-01-14T15:01:00.987Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS JAVA (User Admin Application) Problem Types: CWE-434 Description: SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/no
he scope of victim's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3514421 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0058 State: PUBLISHED Published: 2025-01-14T00:08:59.323Z Last Updated: 2025-01-14T15:00:38.824Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Business Workflow and SAP Flexible Workflow Problem Types: CWE-639 Description: In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.co
to make the information unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3542698 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0059 State: PUBLISHED Published: 2025-01-14T00:09:07.029Z Last Updated: 2025-01-14T14:59:54.719Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Problem Types: CWE-497 Description: Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could
m level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3503138 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0060 State: PUBLISHED Published: 2025-01-14T00:09:14.051Z Last Updated: 2025-01-14T14:59:23.756Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-94 Description: SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application. Additional Analyst Notes:
high privileged user causing high impact on confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3474398 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0061 State: PUBLISHED Published: 2025-01-14T00:09:21.343Z Last Updated: 2025-01-14T14:58:33.186Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-497 Description: SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3474398 - https://url.sap/sapsecurityp
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3474398 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-0062 State: PUBLISHED Published: 2025-03-11T00:31:18.755Z Last Updated: 2025-03-11T02:18:37.752Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-79 Description: SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availabil