Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21437 State: PUBLISHED Published: 2021-03-22T08:50:17.071478Z Last Updated: 2024-09-16T20:53:12.704Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: OTRSCIsInCustomerFrontend, ITSMConfigurationManagement Problem Types: CWE-264 Description: Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects: OTRSCIsInCustomerFrontend 7.0.15 and prior versions, ITSMConfigurationManagement 7.0.24 and prior versions Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-07/
CVE ID: CVE-2021-21438 State: PUBLISHED Published: 2021-03-22T08:50:17.683469Z Last Updated: 2024-09-17T01:46:15.159Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: FAQ, OTRS Problem Types: CWE-264 Description: Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-08/
CVE ID: CVE-2021-21439 State: PUBLISHED Published: 2021-06-14T07:55:10.080008Z Last Updated: 2024-09-16T19:52:22.948Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-754 Description: DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions; 8.0.x version 8.0.13 and prior versions. Additional Analyst No
ns. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions; 8.0.x version 8.0.13 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-09/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-21440 State: PUBLISHED Published: 2021-07-26T04:25:37.050952Z Last Updated: 2024-09-16T17:43:49.726Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-200 Description: Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-
tional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-10/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-21441 State: PUBLISHED Published: 2021-06-16T09:50:11.263977Z Last Updated: 2024-09-16T16:23:02.452Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-79 Description: There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior ver
RS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-11/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-21442 State: PUBLISHED Published: 2021-07-26T04:25:38.681787Z Last Updated: 2024-09-16T20:17:22.058Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: Time Accounting Problem Types: CWE-79 Description: In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-12/
CVE ID: CVE-2021-21443 State: PUBLISHED Published: 2021-07-26T04:25:40.249893Z Last Updated: 2024-09-16T20:11:31.892Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: ((OTRS)) Community Edition, OTRS Problem Types: CWE-200 Description: Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-13/ - https://lists.debian.org/debian-lts-announc
ferences: - https://otrs.com/release-notes/otrs-security-advisory-2021-13/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-21444 State: PUBLISHED Published: 2021-02-09T20:44:22 Last Updated: 2024-08-03T18:16:22.235Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) Problem Types: Clickjacking Description: SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.c
leading to Clickjacking attack. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=568460543 - https://launchpad.support.sap.com/#/notes/2935791
CVE ID: CVE-2021-21445 State: PUBLISHED Published: 2021-01-12T14:42:03 Last Updated: 2024-08-03T18:16:22.329Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Commerce Cloud Problem Types: Header Manipulation Description: SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type header, due to improper input validation, and sent to a Web user. A successful exploitation of this vulnerability may lead to advanced attacks, including cross-site scripting and page hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://
uding cross-site scripting and page hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2984034
CVE ID: CVE-2021-21446 State: PUBLISHED Published: 2021-01-12T14:40:18 Last Updated: 2024-08-03T18:16:22.448Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver AS ABAP Problem Types: Denial of Service Description: SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.
ner: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/3000306
CVE ID: CVE-2021-21447 State: PUBLISHED Published: 2021-01-12T14:40:43 Last Updated: 2024-08-03T18:16:22.247Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface) Problem Types: Cross Site Scripting Description: SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program C
the relevant application content, which leads to Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2965154
CVE ID: CVE-2021-21448 State: PUBLISHED Published: 2021-01-12T14:40:29 Last Updated: 2024-08-03T18:16:22.425Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP GUI FOR WINDOWS Problem Types: Information Disclosure Description: SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on the client PC and not via Network and the attacker needs at least user authorization of the Operating System user of the vict
lient PC and not via Network and the attacker needs at least user authorization of the Operating System user of the victim. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2992269
CVE ID: CVE-2021-21449 State: PUBLISHED Published: 2021-01-12T14:40:09 Last Updated: 2024-08-03T18:16:22.509Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
dation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/3002617
CVE ID: CVE-2021-21450 State: PUBLISHED Published: 2021-01-12T14:39:59 Last Updated: 2024-08-03T18:16:22.529Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21451 State: PUBLISHED Published: 2021-01-12T14:38:55 Last Updated: 2024-08-03T18:16:22.513Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21452 State: PUBLISHED Published: 2021-01-12T14:38:39 Last Updated: 2024-08-03T18:16:22.554Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21453 State: PUBLISHED Published: 2021-01-12T14:39:52 Last Updated: 2024-08-03T18:16:22.555Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21454 State: PUBLISHED Published: 2021-01-12T14:39:07 Last Updated: 2024-08-03T18:16:22.441Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21455 State: PUBLISHED Published: 2021-01-12T14:38:49 Last Updated: 2024-08-03T18:16:22.518Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21456 State: PUBLISHED Published: 2021-01-12T14:40:33 Last Updated: 2024-08-03T18:16:22.338Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21457 State: PUBLISHED Published: 2021-01-12T14:40:37 Last Updated: 2024-08-03T18:16:22.627Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21458 State: PUBLISHED Published: 2021-01-12T14:40:04 Last Updated: 2024-08-03T18:16:22.548Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21459 State: PUBLISHED Published: 2021-01-12T14:38:15 Last Updated: 2024-08-03T18:16:22.608Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21460 State: PUBLISHED Published: 2021-01-12T14:38:28 Last Updated: 2024-08-03T18:16:22.556Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21461 State: PUBLISHED Published: 2021-01-12T14:40:24 Last Updated: 2024-08-03T18:16:22.656Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21462 State: PUBLISHED Published: 2021-01-12T14:40:48 Last Updated: 2024-08-03T18:16:22.654Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21463 State: PUBLISHED Published: 2021-01-12T14:41:55 Last Updated: 2024-08-03T18:16:22.589Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21464 State: PUBLISHED Published: 2021-01-12T14:39:03 Last Updated: 2024-08-03T18:16:22.594Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.ac
CVE ID: CVE-2021-21465 State: PUBLISHED Published: 2021-01-12T14:40:57 Last Updated: 2024-08-03T18:16:22.474Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business Warehouse Problem Types: SQL Injection Description: The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system. Additional Analyst Notes: - CVE Program Container: References: - https
ich can fully compromise the affected SAP system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2986980 - http://seclists.org/fulldisclosure/2022/May/42 - http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
CVE ID: CVE-2021-21466 State: PUBLISHED Published: 2021-01-12T14:42:39 Last Updated: 2024-08-03T18:16:22.469Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business Warehouse, SAP BW/4HANA Problem Types: Code Injection Description: SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact o
which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 - https://launchpad.support.sap.com/#/notes/2999854 - http://seclists.org/fulldisclosure/2022/May/42 - http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html