Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
or upload malicious PHP webshells as "profile pictures." The user IDs can be easily determined by other responses from the API for an event or chat room. Additional Analyst Notes: - CVE Program Container: References: - http://vfairs.com - https://api.vfairs.com/v1/profiles - https://api.vfairs.com/v1/profiles?access_key= - https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack
CVE ID: CVE-2020-26680 State: PUBLISHED Published: 2021-05-26T11:54:59 Last Updated: 2024-08-04T15:56:04.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - http://vfairs.com - https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack
CVE ID: CVE-2020-26682 State: PUBLISHED Published: 2020-10-16T13:19:23 Last Updated: 2024-08-04T15:56:05.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libass/libass/issues/431 - https://github.com/libass/libass/pull/432 - http://www.openwall.com/lists/oss-security/2020/11/19/7 - https://security.gentoo.org/glsa/202012-12
CVE ID: CVE-2020-26683 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T19:24:41.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=702566 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=05720b4ee3dbae57e65546dc2eecc3021c08eeea
CVE ID: CVE-2020-26693 State: PUBLISHED Published: 2021-06-01T14:30:04 Last Updated: 2024-08-04T15:56:05.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pfsense/pfsense/commit/a220a22a8c05c10a7b875ac6b565f2c4fe7b251c
CVE ID: CVE-2020-26701 State: PUBLISHED Published: 2020-11-17T17:55:21 Last Updated: 2024-08-04T15:56:05.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/160082/Kaa-IoT-Platform-1.2.0-Cross-Site-Scripting.html
CVE ID: CVE-2020-26705 State: PUBLISHED Published: 2021-10-31T19:51:53 Last Updated: 2024-08-04T15:56:05.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/darkfoxprime/python-easy_xml/issues/1
CVE ID: CVE-2020-26707 State: PUBLISHED Published: 2021-10-31T19:51:54 Last Updated: 2024-08-04T15:56:05.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shenzhim/aaptjs/issues/2
CVE ID: CVE-2020-26708 State: PUBLISHED Published: 2023-06-29T00:00:00 Last Updated: 2024-11-27T14:41:47.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/erinxocon/requests-xml/issues/7 - https://security.netapp.com/advisory/ntap-20230908-0003/
CVE ID: CVE-2020-26709 State: PUBLISHED Published: 2023-06-29T00:00:00 Last Updated: 2024-11-27T14:39:29.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PinaeOS/py-xml/issues/2
CVE ID: CVE-2020-26710 State: PUBLISHED Published: 2023-06-29T00:00:00 Last Updated: 2024-11-27T14:38:17.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/uncmath25/easy-parse/issues/3
CVE ID: CVE-2020-26712 State: PUBLISHED Published: 2021-01-12T14:17:33 Last Updated: 2024-08-04T15:56:04.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases. Additional Analyst Notes: - CVE Program Container: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.project-redcap.org/ - https://github.com
ww.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.project-redcap.org/ - https://github.com/vuongdq54/RedCap
CVE ID: CVE-2020-26713 State: PUBLISHED Published: 2021-01-12T14:17:55 Last Updated: 2024-08-04T15:56:05.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts. Additional Analyst Notes: - CVE Program Container: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.project-redcap.org/ - htt
es: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://www.project-redcap.org/ - https://github.com/vuongdq54/RedCap
CVE ID: CVE-2020-26728 State: PUBLISHED Published: 2022-02-11T18:05:36 Last Updated: 2024-08-04T15:56:05.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Lyc-heng/Router/blob/main/Tenda/rce1.md - https://github.com/Lyc-heng/routers/blob/a80b30bccfc9b76f3a4868ff28ad5ce2e0fca180/routers/rce1.md - https://github.com/Lyc-heng/routers/blob/main/routers/rce1.md
CVE ID: CVE-2020-26732 State: PUBLISHED Published: 2021-01-14T00:00:00 Last Updated: 2024-08-16T19:39:23.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/swzhouu/CVE-2020-26732
CVE ID: CVE-2020-26733 State: PUBLISHED Published: 2021-01-14T15:57:23 Last Updated: 2024-08-04T16:03:21.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/swzhouu/CVE-2020-26733
CVE ID: CVE-2020-26759 State: PUBLISHED Published: 2021-01-06T12:56:55 Last Updated: 2024-08-04T16:03:21.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mymarilyn/clickhouse-driver/commit/d708ed548e1d6f254ba81a21de8ba543a53b5598 - https://github.com/mymarilyn/clickhouse-driver/commit/3e990547e064b8fca916b23a0f7d6fe8c63c7f6b
CVE ID: CVE-2020-26762 State: PUBLISHED Published: 2020-12-01T14:56:08 Last Updated: 2024-08-04T16:03:21.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorized attacker to perform remote-code-execution due to a crafted GET-Request. The overflow occurs in binary ipcam_cgi due to a missing type check in function doGetSysteminfo(). This has been fixed in version: IC-3116W v3.08. Additional Analyst Notes: - CVE Program Container: References: - https://www.edimax.com/edimax/download/download/data/edimax/de/download/for_home/home_network_cameras/hom
References: - https://www.edimax.com/edimax/download/download/data/edimax/de/download/for_home/home_network_cameras/home_network_cameras_indoor_fixed/ic-3116w
CVE ID: CVE-2020-26763 State: PUBLISHED Published: 2021-07-05T14:49:09 Last Updated: 2024-08-04T16:03:21.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rocket.Chat desktop application 2.17.11 opens external links without user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RocketChat/Rocket.Chat.Electron/pull/1710
CVE ID: CVE-2020-26766 State: PUBLISHED Published: 2020-12-26T01:54:20 Last Updated: 2024-08-04T16:03:21.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management System With Admin Panel 2.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49180
CVE ID: CVE-2020-26768 State: PUBLISHED Published: 2021-01-07T12:43:12 Last Updated: 2024-08-04T16:03:22.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site once the URL is clicked or visited. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials, force malware e
An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials, force malware execution, user redirection and others. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Formstone/Formstone/issues/286
CVE ID: CVE-2020-26772 State: PUBLISHED Published: 2021-09-08T20:18:24 Last Updated: 2024-08-04T16:03:21.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function. Additional Analyst Notes: - CVE Program Container: References: - https://blog.csdn.net/qq_33020901/article/details/108938473 - https://github.com/george518/PPGo_Job/issues/56
CVE ID: CVE-2020-26773 State: PUBLISHED Published: 2021-01-07T14:19:01 Last Updated: 2024-08-04T16:03:21.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker to execute arbitrary SQL commands via the date parameter in includes/reservation.inc.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/14482/restaurant-reservation-system-php-full-source-code-2020.html - https://packetstormsecurity.com/files/159475/Restaurant-Reservation-System-1.0-SQL-Injection.html
CVE ID: CVE-2020-26797 State: PUBLISHED Published: 2021-03-18T19:17:32 Last Updated: 2024-08-04T16:03:21.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/mediainfo/bugs/1154/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYI2372RLWYQVLSYD5PBI4YTXNMVDZCZ/
CVE ID: CVE-2020-26799 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-21T18:56:22.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.luxsoft.eu/index.php?pge=dload - https://youtu.be/npw9jcQ1h1U - https://suryadina.com/luxcal-reflected-xss-cve-2020-26799/
CVE ID: CVE-2020-26800 State: PUBLISHED Published: 2021-01-11T12:50:11 Last Updated: 2024-08-04T16:03:22.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/aleth - https://ethereum.org/en/about/ - https://github.com/ethereum/aleth/issues/5917
CVE ID: CVE-2020-26801 State: PUBLISHED Published: 2021-06-25T12:07:13 Last Updated: 2024-08-04T16:03:22.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - http://su2200rtxl2ua.com - http://tripplite.com - https://www.blacklanternsecurity.com/2021-06-21-Tripplite-CVE/
CVE ID: CVE-2020-26802 State: PUBLISHED Published: 2020-10-08T16:38:49 Last Updated: 2024-08-04T16:03:22.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48494
CVE ID: CVE-2020-26803 State: PUBLISHED Published: 2020-11-12T18:52:45 Last Updated: 2024-08-04T16:03:22.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab. This "Upload Images" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated_6.html
CVE ID: CVE-2020-26804 State: PUBLISHED Published: 2020-11-12T18:52:42 Last Updated: 2024-08-04T16:03:22.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html
CVE ID: CVE-2020-26805 State: PUBLISHED Published: 2020-11-12T18:52:40 Last Updated: 2024-08-04T16:03:22.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2. In this POST request, "employeeNumId" parameter is affected by SQLi vulnerability. Attacker can inject SQL commands into query, read data from database or write data into the database. Additional Analyst Notes: - CVE Program Container: References: - https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-sqli.html
CVE ID: CVE-2020-26806 State: PUBLISHED Published: 2021-07-31T16:13:31 Last Updated: 2024-08-04T16:03:22.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/163709/ObjectPlanet-Opinio-7.13-Shell-Upload.html - https://www.objectplanet.com/opinio/changelog.html
CVE ID: CVE-2020-26807 State: PUBLISHED Published: 2020-11-10T16:20:55 Last Updated: 2024-08-04T16:03:22.746Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP SE Products: SAP ERP Client for E-Bilanz 1.0 Problem Types: Incorrect Default Permissions Description: SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone to modify the files in the folder. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 - https://launchpad.support.sap.com/#/notes/2971112
CVE ID: CVE-2020-26808 State: PUBLISHED Published: 2020-11-10T16:12:24 Last Updated: 2024-08-04T16:03:22.579Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP AS ABAP(DMIS), SAP S4 HANA(DMIS) Problem Types: Code Injection Description: SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application. Addi
an be executed in the application which affects the confidentiality, availability and integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2973735 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 - http://seclists.org/fulldisclosure/2022/May/42 - http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
CVE ID: CVE-2020-26809 State: PUBLISHED Published: 2020-11-10T16:10:56 Last Updated: 2024-08-04T16:03:22.462Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Commerce Cloud Problem Types: Information Disclosure Description: SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.s
ct system configuration confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 - https://launchpad.support.sap.com/#/notes/2975189 - http://seclists.org/fulldisclosure/2021/Jun/27 - http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html
CVE ID: CVE-2020-26810 State: PUBLISHED Published: 2020-11-10T16:20:28 Last Updated: 2024-08-04T16:03:22.387Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP Commerce Cloud (Accelerator Payment Mock) Problem Types: Denial of Service Description: SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integri
er the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 - https://launchpad.support.sap.com/#/notes/2975170
CVE ID: CVE-2020-26811 State: PUBLISHED Published: 2020-11-10T16:12:03 Last Updated: 2024-08-04T16:03:22.453Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Commerce Cloud (Accelerator Payment Mock) Problem Types: Server-Side Request Forgery Description: SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Request Forgery attack which could lead to retrieval of limited pieces of information about the
est leads to Server Side Request Forgery attack which could lead to retrieval of limited pieces of information about the service with no impact on integrity or availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 - https://launchpad.support.sap.com/#/notes/2975170 - http://seclists.org/fulldisclosure/2021/Jun/26 - http://packetstormsecurity.com/files/163143/SAP-Hybris-eCommerce-Server-Side-Request-Forgery.html