Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-0229 State: PUBLISHED Published: 2019-04-10T19:51:13 Last Updated: 2024-08-04T17:44:15.942Z Vendors: n/a Products: Apache Airflow Problem Types: CSRF Description: A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231%40%3Cdev.airflow.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/04/10/6 - http://www.securityfocus.com/bid/107869
CVE ID: CVE-2019-0230 State: PUBLISHED Published: 2020-09-14T16:41:27 Last Updated: 2024-08-04T17:44:15.965Z Vendors: n/a Products: Apache Struts Problem Types: Remote Code Execution Description: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/ww/s2-059 - https://www.oracle.com/security-alerts/cpujan2021.html - http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html - https://launchpad.support.sap.com/#/notes/2982840 - http://packetstormsecurity.com/
2.5.20-Double-OGNL-Evaluation.html - https://launchpad.support.sap.com/#/notes/2982840 - http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html - https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2019-0231 State: PUBLISHED Published: 2019-10-01T19:39:53.189Z Last Updated: 2025-02-13T16:27:19.692Z Vendors: Apache Software Foundation Products: Apache MINA Problem Types: SSLFilter security Issue Description: Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA. Additional Analyst Notes: - CVE Program Container: References: - http://mina.apache.org/mina-project/index.html#mina-211-mina-2021-released-posted-on
VE Program Container: References: - http://mina.apache.org/mina-project/index.html#mina-211-mina-2021-released-posted-on-april-14-2019
CVE ID: CVE-2019-0232 State: PUBLISHED Published: 2019-04-15T14:23:52 Last Updated: 2024-08-04T17:44:15.941Z Vendors: Apache Products: Tomcat Problem Types: Remote Code Execution Description: When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behavi
be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/5f297a4b9080b5f65a05bc139596d0e437d6a539b25e31d29d028767%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c
437d6a539b25e31d29d028767%40%3Cannounce.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/673b6148d92cd7bc99ea2dcf85ad75d57da44fc322d51f37fb529a2a%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/a6c87a09a71162fd563ab1c4e70a08a103e0b7c199fc391f1c9c4c35%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - h
/lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/52ffb9fbf661245386a83a661183d13f1de2e5779fa23837a08e02ac%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/dd4b325cdb261183dbf5ce913c102920a8f09c26dae666a98309165b%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/96849486813a95dfd542e1618b7923ca945508aaf4a4341f674d83e3%40%3Cnotifications.ofbiz.apache.org%3E - http://www.securityfocus.com/bid/107906 - https://lists.apache.org/thread.html/f4d48b32ef2b6aa49c8830241a9475da5b46e451f964b291c7a0a715%40%3Cdev.tomcat.apache.org%3E - http://seclist
.org/thread.html/f4d48b32ef2b6aa49c8830241a9475da5b46e451f964b291c7a0a715%40%3Cdev.tomcat.apache.org%3E - http://seclists.org/fulldisclosure/2019/May/4 - https://access.redhat.com/errata/RHSA-2019:1712 - https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuAp
019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html - https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/ - https://www.synology.com/security/advisory/Synology_SA_19_17 - https://security.netapp.com/advisory/ntap-20190419-0001/ - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-784 - https://blog.trendmicro.com/trendlabs-security-intelligence/uncov
curity-advisories/brocade-security-advisory-2019-784 - https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/ - https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ - http://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html
CVE ID: CVE-2019-0233 State: PUBLISHED Published: 2020-09-14T16:50:11 Last Updated: 2024-08-04T17:44:15.954Z Vendors: n/a Products: Apache Struts Problem Types: Denial of Service Description: An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/ww/s2-060 - https://www.oracle.com/security-alerts/cpujan2021.html - https://launchpad.support.sap.com/#/notes/2982840 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2019-0234 State: PUBLISHED Published: 2019-07-15T21:13:14 Last Updated: 2024-08-04T17:44:15.970Z Vendors: Apache Products: Apache Roller Problem Types: Information Disclosure Description: A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of Roller, which is now Roller 5.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/26cdef3fa8a8fa7fcbb99320aa860836ead124b414c654a4d12674cf%40%3Cd
iner: References: - https://lists.apache.org/thread.html/26cdef3fa8a8fa7fcbb99320aa860836ead124b414c654a4d12674cf%40%3Cdev.roller.apache.org%3E - https://lists.apache.org/thread.html/r81a61626d03a11e610c4fbf641f19a6075a0d082906388826829663d%40%3Cuser.roller.apache.org%3E
CVE ID: CVE-2019-0235 State: PUBLISHED Published: 2020-04-30T19:22:20 Last Updated: 2024-08-04T17:44:15.925Z Vendors: Apache Products: Apache OFBiz Problem Types: CSRF Vulnerability Description: Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/n4vnt - http://packetstormsecurity.com/files/157514/Apache-OFBiz-17.12.03-Cross-Site-Request-Forgery.html - https://lists.apache.org/thread.html/rbd572bb27991835a3455c1bf694e7140d79ab03cdb9e6e50fd1219d7%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r392206f7cd131f0fc3f7c60a767ced93ced00411d55c1777c219c956%40%3Cnotifications.ofb
- https://lists.apache.org/thread.html/r392206f7cd131f0fc3f7c60a767ced93ced00411d55c1777c219c956%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rfe36dc9135810954ef667d29129d02207fb999a286b60d33bd9c2349%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r9eeb6c41d2c562b451f1e48ec56881f59107cc4dea7c883db2c5373d%40%3Cnotifications.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/rb53870d24088956a555683aa1aea7e532e3be65b863b9c75eac31b90%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.ht
0890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
CVE ID: CVE-2019-0238 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:15.951Z Vendors: SAP SE Products: SAP Commerce (ex. SAP Hybris Commerce) Problem Types: Cross-Site Scripting Description: SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106462 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - https://launchpad.support.sap.com/#/notes/2697573
CVE ID: CVE-2019-0240 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.021Z Vendors: SAP SE Products: SAP Business Objects Mobile for Android Problem Types: Denial of Service Description: SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legitimate users from accessing the application by crashing it. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - http://www.securityfocus.com/bid/106470 - https://launchpad.support.sap.com/#/notes/2724059
CVE ID: CVE-2019-0241 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.098Z Vendors: SAP SE Products: SAP Work and Inventory Manager (Agentry_SDK) Problem Types: Denial of Service Description: SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - http://www.securityfocus.com/bid/106461 - https://launchpad.support.sap.com/#/notes/2725538
CVE ID: CVE-2019-0243 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:15.938Z Vendors: SAP SE Products: SAP BW/4HANA (DW4CORE) Problem Types: Missing Authorization Check Description: Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2727623 - http://www.securityfocus.com/bid/106467 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985
CVE ID: CVE-2019-0244 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.026Z Vendors: SAP SE Products: SAP CRM WebClient UI (SAPSCORE), SAP CRM WebClient UI (S4FND), SAP CRM WebClient UI (WEBCUIF) Problem Types: Cross-Site Scripting Description: SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2588763 - http://www.securityfocus.com/bid/106473 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pa
p.com/#/notes/2588763 - http://www.securityfocus.com/bid/106473 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985
CVE ID: CVE-2019-0245 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:15.952Z Vendors: SAP SE Products: SAP CRM WebClient UI (SAPSCORE), SAP CRM WebClient UI (S4FND), SAP CRM WebClient UI (WEBCUIF) Problem Types: Cross-Site Scripting Description: SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2588763 - http://www.securityfocus.com/bid/106468 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pa
p.com/#/notes/2588763 - http://www.securityfocus.com/bid/106468 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985
CVE ID: CVE-2019-0246 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.331Z Vendors: SAP SE Products: SAP Cloud Connector Problem Types: Missing Authentication Description: SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2696233 - http://www.securityfocus.com/bid/106463 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985
CVE ID: CVE-2019-0247 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.249Z Vendors: SAP SE Products: SAP Cloud Connector Problem Types: Code Injection Description: SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2696233 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985
CVE ID: CVE-2019-0248 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.209Z Vendors: SAP SE Products: SAP Gateway of ABAP Application Server(SAP_GWFND), SAP Gateway of ABAP Application Server(SAP_BASIS) Problem Types: Information Disclosure Description: Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106471 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - https://launchpad.support.sap.com/#
/bid/106471 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - https://launchpad.support.sap.com/#/notes/2723142
CVE ID: CVE-2019-0249 State: PUBLISHED Published: 2019-01-08T20:00:00 Last Updated: 2024-08-04T17:44:16.381Z Vendors: SAP SE Products: SAP Landscape Management(VCM) Problem Types: Information Disclosure Description: Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 - http://www.securityfocus.com/bid/106464 - https://launchpad.support.sap.com/#/notes/2727624
CVE ID: CVE-2019-0251 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.593Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Fiori Launchpad) Problem Types: Cross-Site Scripting Description: The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - http://www.securityfocus.com/bid/106993 - https://launchpad.support.sap.com/#/notes/2638175
CVE ID: CVE-2019-0254 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.378Z Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Cross-Site Scripting Description: SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107004 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2706798
CVE ID: CVE-2019-0255 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://laun
CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2723570 - http://www.securityfocus.com/bid/106987
CVE ID: CVE-2019-0256 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.192Z Vendors: SAP SE Products: SAP Business One Mobile Android App Problem Types: Information Disclosure Description: Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2723878 - http://www.securityfocus.com/bid/106995
CVE ID: CVE-2019-0257 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.190Z Vendors: SAP SE Products: ABAP Platform(SAP Basis) Problem Types: Missing Authorization Check Description: Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2728839 - http://www
scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2728839 - http://www.securityfocus.com/bid/106999
CVE ID: CVE-2019-0258 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.456Z Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Missing Authorization Check Description: SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2724014 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - http://www.securityfocus.com/bid/106969
CVE ID: CVE-2019-0259 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.377Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform Servers (Enterprise) Problem Types: Unrestricted File Upload Description: SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106997 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2727564
CVE ID: CVE-2019-0261 State: PUBLISHED Published: 2019-02-15T18:00:00 Last Updated: 2024-08-04T17:44:16.376Z Vendors: SAP SE Products: SAP HANA Extended Application Services Problem Types: Missing Authentication Check Description: Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/27
s: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 - https://launchpad.support.sap.com/#/notes/2742027 - http://www.securityfocus.com/bid/106986