Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ferences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3035472
CVE ID: CVE-2021-27595 State: PUBLISHED Published: 2021-03-22T16:58:20 Last Updated: 2024-08-03T21:26:09.714Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.s
tainer: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3035472
CVE ID: CVE-2021-27596 State: PUBLISHED Published: 2021-03-22T16:58:30 Last Updated: 2024-08-03T21:26:09.922Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.supp
m Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 - https://launchpad.support.sap.com/#/notes/3035472
CVE ID: CVE-2021-27597 State: PUBLISHED Published: 2021-06-09T00:00:00 Last Updated: 2024-08-03T21:26:09.711Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver AS for ABAP (RFC Gateway) Problem Types: CWE-125 Description: SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validatio
ecially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method memmove() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3020209
CVE ID: CVE-2021-27598 State: PUBLISHED Published: 2021-04-13T18:38:46 Last Updated: 2024-08-03T21:26:10.214Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS for JAVA (Customer Usage Provisioning Servlet) Problem Types: CWE-284 Description: SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3027937 - https://wiki.scn.sap.com/wiki/page
Program Container: References: - https://launchpad.support.sap.com/#/notes/3027937 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649
CVE ID: CVE-2021-27599 State: PUBLISHED Published: 2021-04-14T14:23:01 Last Updated: 2024-08-03T21:26:09.784Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Process Integration (Integration Builder Framework) Problem Types: Information Disclosure Description: SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker to access information under certain conditions, which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - http
otes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3012277
CVE ID: CVE-2021-27600 State: PUBLISHED Published: 2021-04-13T18:43:37 Last Updated: 2024-08-03T21:26:10.234Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Manufacturing Execution (System Rules) Problem Types: Cross Site Scripting Description: SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.
resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be impacted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3024414
CVE ID: CVE-2021-27601 State: PUBLISHED Published: 2021-04-13T18:43:53 Last Updated: 2024-08-03T21:26:10.336Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS for Java (Applications based on HTMLB for Java) Problem Types: Cross Site Scripting Description: SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attacker does not have control over kind or degree. Additional Analyst Notes: - CV
an read and modify data. However, the attacker does not have control over kind or degree. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/2963592
CVE ID: CVE-2021-27602 State: PUBLISHED Published: 2021-04-13T18:41:24 Last Updated: 2024-08-03T21:26:10.373Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Commerce Problem Types: Code Injection Description: SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the applica
perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3040210
CVE ID: CVE-2021-27603 State: PUBLISHED Published: 2021-04-13T18:40:46 Last Updated: 2024-08-03T21:26:10.122Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver AS for ABAP Problem Types: Denial of Service Description: An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/
ailability of the SAP system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3028729
CVE ID: CVE-2021-27604 State: PUBLISHED Published: 2021-04-14T14:22:16 Last Updated: 2024-08-03T21:26:09.798Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Process Integration (Enterprise Service Repository JAVA Mappings) Problem Types: CWE-611 Description: In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 -
yst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3036436
CVE ID: CVE-2021-27605 State: PUBLISHED Published: 2021-04-13T18:44:13 Last Updated: 2024-08-03T21:26:10.200Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Fiori Apps 2.0 for Travel Management in SAP ERP Problem Types: Missing Authorization Description: SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last name, first name of the employees, so there is some loss of confidential information, Integr
some information like last name, first name of the employees, so there is some loss of confidential information, Integrity and Availability are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3025054
CVE ID: CVE-2021-27606 State: PUBLISHED Published: 2021-06-09T00:00:00 Last Updated: 2024-08-03T21:26:10.112Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server) Problem Types: CWE-125 Description: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to im
he system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncOAMParamStore() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3020104
CVE ID: CVE-2021-27607 State: PUBLISHED Published: 2021-06-09T00:00:00 Last Updated: 2024-08-03T21:26:09.719Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher) Problem Types: CWE-476 Description: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an i
acker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThSncIn() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3021197
CVE ID: CVE-2021-27608 State: PUBLISHED Published: 2021-04-14T14:23:21 Last Updated: 2024-08-03T21:26:09.728Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Setup Problem Types: Unquoted Search Path or Element (CWE - 428) Description: An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable file is registered. This could further lead to complete compromise of confidentiality, Integrity and Availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - htt
Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3039649
CVE ID: CVE-2021-27609 State: PUBLISHED Published: 2021-04-13T18:45:06 Last Updated: 2024-08-03T21:26:10.134Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP SE Products: SAP Focused RUN Problem Types: Missing Authorization Check Description: SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without the intended authorization. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=5
ional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 - https://launchpad.support.sap.com/#/notes/3030948
CVE ID: CVE-2021-27610 State: PUBLISHED Published: 2021-06-16T14:45:57 Last Updated: 2024-08-03T21:26:09.712Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: Improper Authentication Description: SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system. Additional Analyst Notes: - CVE Program Container
loited by malicious users to obtain illegitimate access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3007182
CVE ID: CVE-2021-27611 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:09.917Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver AS ABAP Problem Types: Code Injection Description: SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - h
t Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3046610
CVE ID: CVE-2021-27612 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:10.276Z Severity: LOW (CVSS 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: SAP SE Products: SAP GUI for Windows Problem Types: URL Redirection to Untrusted Site Description: In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3023078
CVE ID: CVE-2021-27613 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:09.713Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business One (Cookbooks) Problem Types: Information Disclosure Description: Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information which would otherwise be restricted, which could lead to Information Disclosure and highly impact system confidentiality, integrity and availability. Additional Analyst Note
to Information Disclosure and highly impact system confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3049755 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655
CVE ID: CVE-2021-27614 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:10.401Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: SAP SE Products: SAP Business One, version for SAP HANA (Cookbooks) Problem Types: Code Injection Description: SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application thereby highly impacting the integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: Refe
hly impacting the integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3049661
CVE ID: CVE-2021-27615 State: PUBLISHED Published: 2021-06-09T13:25:03 Last Updated: 2024-08-03T21:26:10.142Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Manufacturing Execution Problem Types: Cross-Site Scripting (XSS) Description: SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers in response can be exploited by the attacker to execute Cross-Site Scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.supp
m Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 - https://launchpad.support.sap.com/#/notes/3030961
CVE ID: CVE-2021-27616 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:10.457Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business One, version for SAP HANA (Cookbooks) Problem Types: Information Disclosure Description: Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted, resulting in Information Disclosure vulnerability highly impacting the confidentiality, integrity and availabil
tricted, resulting in Information Disclosure vulnerability highly impacting the confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3049661
CVE ID: CVE-2021-27617 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:10.393Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP Process Integration (Integration Builder Framework) Problem Types: Missing XML Validation Description: The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to Denial-of-service conditions due to consumption of a large amount of system memory, thus hig
application, could lead to Denial-of-service conditions due to consumption of a large amount of system memory, thus highly impacting system availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3012021
CVE ID: CVE-2021-27618 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:10.279Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP Process Integration (Integration Builder Framework) Problem Types: Unrestricted File Upload Description: The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and upload it to the application, which could lead to denial of service and impact the availability of the application. Additional Analyst Notes: -
tion, which could lead to denial of service and impact the availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3012021
CVE ID: CVE-2021-27619 State: PUBLISHED Published: 2021-05-11T14:19:33 Last Updated: 2024-08-03T21:26:10.147Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Commerce (Backoffice Search) Problem Types: Information Disclosure Description: SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure. Additional Analyst Notes: - CVE Program C
etermine the masked attribute value thereby leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 - https://launchpad.support.sap.com/#/notes/3039818