Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-0305 State: PUBLISHED Published: 2019-06-12T14:21:39 Last Updated: 2024-08-04T17:44:16.457Z Vendors: SAP SE Products: SAP NetWeaver Process Integration(SAP_XIESR and SAP_XITOOL) Problem Types: Clickjacking Description: Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data. Additional Analyst Notes: - CVE Program Container: References: - https:
y leads to unwanted modification of user's data. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2755502 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0306 State: PUBLISHED Published: 2019-06-12T14:21:39 Last Updated: 2024-08-04T17:44:16.483Z Vendors: SAP SE Products: SAP HANA Extended Application Services (advanced model) Problem Types: Information Disclosure Description: SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2771128 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0307 State: PUBLISHED Published: 2019-06-12T14:21:39 Last Updated: 2024-08-04T17:44:16.441Z Vendors: SAP SE Products: SAP Solution Manager(Diagnostics Agent) Problem Types: Information Disclosure Description: Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/
ion can be gained. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2772266 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0308 State: PUBLISHED Published: 2019-06-12T14:21:39 Last Updated: 2024-08-04T17:44:16.439Z Vendors: SAP SE Products: SAP E-Commerce (Business-to-Consumer application) Problem Types: Code Injection Description: An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2773493 - http
dditional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2773493 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0311 State: PUBLISHED Published: 2019-06-12T16:11:08 Last Updated: 2024-08-04T17:44:16.455Z Vendors: SAP SE Products: SAP R/3 Enterprise Application Problem Types: Cross-Site Scripting Description: Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2728153 - ht
Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2728153 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0312 State: PUBLISHED Published: 2019-06-12T16:11:08 Last Updated: 2024-08-04T17:44:16.453Z Vendors: SAP SE Products: SAP NetWeaver Process Integration(SAP_XIESR), SAP NetWeaver Process Integration(SAP_XITOOL) Problem Types: Information Disclosure Description: Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings. Additional Analyst Notes: - CVE Program Container: References:
in the absence of restrictive firewall and port settings. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2744086 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0314 State: PUBLISHED Published: 2019-06-12T16:11:08 Last Updated: 2024-08-04T17:44:16.468Z Vendors: SAP SE Products: SAP Work Manager, SAP Inventory Manager Problem Types: Denial of Service Description: SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2793805 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0315 State: PUBLISHED Published: 2019-06-12T16:11:08 Last Updated: 2024-08-04T17:44:16.439Z Vendors: SAP SE Products: SAP NetWeaver Process Integration(SAP_XIESR), SAP NetWeaver Process Integration(SAP_XITOOL), SAP NetWeaver Process Integration(SAP_XIPCK) Problem Types: Information Disclosure Description: Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 and SAP_XIPCK 7.10 to 7.11, 7.20, 7.30) allows an attacker to access passwords used in FTP channels leading to information disclosure. Additional Analyst Notes: - CV
s an attacker to access passwords used in FTP channels leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2755438 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
CVE ID: CVE-2019-0316 State: PUBLISHED Published: 2019-06-14T18:50:55 Last Updated: 2024-08-04T17:44:16.455Z Vendors: SAP SE Products: SAP NetWeaver Process Integration(SAP_XIESR), SAP NetWeaver Process Integration(SAP_XITOOL) Problem Types: Cross-Site Scripting Description: SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in ref
certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 - https://launchpad.support.sap.com/#/notes/2745917
CVE ID: CVE-2019-0318 State: PUBLISHED Published: 2019-07-10T18:48:07 Last Updated: 2024-08-04T17:44:16.482Z Vendors: SAP SE Products: SAP NetWeaver Application Server for Java (Startup Framework) Problem Types: Information Disclosure Description: Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109069 - https://launchpad.support.sap.com/#/notes/2738791 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0319 State: PUBLISHED Published: 2019-07-10T18:51:55 Last Updated: 2024-08-04T17:44:16.458Z Vendors: SAP SE Products: SAP Gateway Problem Types: Content Injection Description: The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109074 - https://launchpad.support.sap.com/#/notes/2752614 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 - https://cxsecurity.com/a
ap.com/#/notes/2752614 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 - https://cxsecurity.com/ascii/WLB-2019050283 - https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f - http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html - https://launchpad.support.sap.com/#/notes/2911267
CVE ID: CVE-2019-0321 State: PUBLISHED Published: 2019-07-10T18:54:44 Last Updated: 2024-08-04T17:44:16.476Z Vendors: SAP SE Products: ABAP Server and ABAP Platform (SAP Basis) Problem Types: Cross-Site Scripting Description: ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109078 - https://launchpad.support.sap.com/#/notes/2773888 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0322 State: PUBLISHED Published: 2019-07-10T19:00:32 Last Updated: 2024-08-04T17:44:16.479Z Vendors: SAP SE Products: SAP Commerce Cloud (ex SAP Hybris Commerce) (HY_COM) Problem Types: Denial of Service Description: SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109076 - https://launchpad.support.sap.com/#/notes/2781873 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0325 State: PUBLISHED Published: 2019-07-10T19:04:13 Last Updated: 2024-08-04T17:44:16.457Z Vendors: SAP SE Products: SAP ERP HCM (SAP_HRCES) Problem Types: Missing Authorization Description: SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109075 - https://launchpad.support.sap.com/#/notes/2798133 - https://wi
: References: - http://www.securityfocus.com/bid/109075 - https://launchpad.support.sap.com/#/notes/2798133 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0326 State: PUBLISHED Published: 2019-07-10T19:07:58 Last Updated: 2024-08-04T17:44:16.440Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform - BI Workspace (Enterprise) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109072 - https://launchpad.support.sap.com/#/notes/2764733 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=5239945
- https://launchpad.support.sap.com/#/notes/2764733 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0327 State: PUBLISHED Published: 2019-07-10T19:09:39 Last Updated: 2024-08-04T17:44:16.446Z Vendors: SAP SE Products: SAP NetWeaver for Java Application Server - Web Container (engineapi) , SAP NetWeaver for Java Application Server - Web Container (servercode) Problem Types: Unrestricted File Upload Description: SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109071 -
t validation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109071 - https://launchpad.support.sap.com/#/notes/2777910 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0328 State: PUBLISHED Published: 2019-07-10T19:10:37 Last Updated: 2024-08-04T17:44:16.476Z Vendors: SAP SE Products: SAP NetWeaver Process Integration ABAP tests (SAP Basis) Problem Types: Code Injection Description: ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109067 - https://launchpad.support.sap.com/#/notes/2774489 - https://wiki.scn.sap.com/wiki/pages/viewpage.a
ocus.com/bid/109067 - https://launchpad.support.sap.com/#/notes/2774489 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0329 State: PUBLISHED Published: 2019-07-10T19:11:25 Last Updated: 2024-08-04T17:44:16.520Z Vendors: SAP SE Products: SAP Information Steward Problem Types: Cross-Site Scripting Description: SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109070 - https://launchpad.support.sap.com/#/notes/2804833 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0330 State: PUBLISHED Published: 2019-07-10T19:12:16 Last Updated: 2024-08-04T17:44:16.508Z Vendors: SAP SE Products: SAP Diagnostic Agent (LM-Service) Problem Types: Code Injection Description: The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109068 - https://launchpad.support.sap.com/#/notes/2808158 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=5
09068 - https://launchpad.support.sap.com/#/notes/2808158 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE ID: CVE-2019-0331 State: PUBLISHED Published: 2019-08-14T13:43:15 Last Updated: 2024-08-04T17:44:16.543Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace) Problem Types: Information Disclosure Description: Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2742468 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
CVE ID: CVE-2019-0332 State: PUBLISHED Published: 2019-08-14T13:44:00 Last Updated: 2024-08-04T17:44:16.487Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Info View) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2742468 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
CVE ID: CVE-2019-0333 State: PUBLISHED Published: 2019-08-14T13:47:36 Last Updated: 2024-08-04T17:44:16.500Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Problem Types: Information Disclosure Description: In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - ht
Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2764513
CVE ID: CVE-2019-0334 State: PUBLISHED Published: 2019-08-14T13:48:51 Last Updated: 2024-08-04T17:44:16.482Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (BI Workspace) Problem Types: Cross-Site Scripting Description: When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.c
to Stored Cross Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2771221
CVE ID: CVE-2019-0335 State: PUBLISHED Published: 2019-08-14T13:44:29 Last Updated: 2024-08-04T17:44:16.490Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (CMC) Problem Types: Cross-Site Scripting Description: Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack. Additional Analyst Notes: -
he little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2742468 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
CVE ID: CVE-2019-0337 State: PUBLISHED Published: 2019-08-14T13:47:00 Last Updated: 2024-08-04T17:44:16.510Z Vendors: SAP SE Products: SAP NetWeaver Process Integration (Java Proxy Runtime) Problem Types: Cross-Site Scripting Description: Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/
eferences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2789866
CVE ID: CVE-2019-0338 State: PUBLISHED Published: 2019-08-14T13:49:43 Last Updated: 2024-08-04T17:44:16.440Z Vendors: SAP SE Products: SAP Gateway Problem Types: Information Disclosure Description: During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2793351
CVE ID: CVE-2019-0340 State: PUBLISHED Published: 2019-08-14T13:51:45 Last Updated: 2024-08-04T17:44:16.515Z Vendors: SAP SE Products: SAP Enable Now Problem Types: Missing XML Validation Description: The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2794742
CVE ID: CVE-2019-0341 State: PUBLISHED Published: 2019-08-14T13:50:44 Last Updated: 2024-08-04T17:44:16.467Z Vendors: SAP SE Products: SAP Enable Now Problem Types: Information Disclosure Description: The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2794742
CVE ID: CVE-2019-0343 State: PUBLISHED Published: 2019-08-14T13:53:05 Last Updated: 2024-08-04T17:44:16.564Z Vendors: SAP SE Products: SAP Commerce Cloud (Mediaconversion Extension) Problem Types: Code Injection Description: SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2786035
CVE ID: CVE-2019-0344 State: PUBLISHED Published: 2019-08-14T13:53:21.000Z Last Updated: 2025-10-21T23:45:32.174Z Vendors: SAP SE Products: SAP Commerce Cloud (virtualjdbc extension) Problem Types: Code Injection Description: Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2786035