Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-6163 State: PUBLISHED Published: 2020-01-08T01:45:12 Last Updated: 2024-08-04T08:55:22.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/PropertySuggestionsWidget.mustache+dom file). Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T240773 - https://gerrit.wikimedia.org/r/558203
CVE ID: CVE-2020-6164 State: PUBLISHED Published: 2020-07-15T20:32:16 Last Updated: 2024-08-04T08:55:21.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to execution in a CLI context, and is not known to present a vulnerability through web-based access. As a side-effect, this preconfigured path also blocks the creation of other resources on this path (e.g. a page). Additional Analyst Not
, this preconfigured path also blocks the creation of other resources on this path (e.g. a page). Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/CVE-2020-6164
CVE ID: CVE-2020-6165 State: PUBLISHED Published: 2020-07-15T20:27:39 Last Updated: 2024-08-04T08:55:21.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that should have failed a permission check being added to the final result set. GraphQL endpoints are configured by default (e.g., for assets), but the admin/graphql endpoint is access p
l result set. GraphQL endpoints are configured by default (e.g., for assets), but the admin/graphql endpoint is access protected by default. This limits the vulnerability to all authenticated users, including those with limited permissions (e.g., where viewing records exposed through admin/graphql requires administrator permissions). However, if custom GraphQL endpoints have been configured for a specific implementation (usually under /graphql), this vulnerability could also be exploited through unauthenticated requests. This vulnerability only applies to reading records; it does not allow unauthorised changing of records. Additional Analyst Notes: - CVE Program Container: References: - http
t does not allow unauthorised changing of records. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/CVE-2020-6165
CVE ID: CVE-2020-6166 State: PUBLISHED Published: 2020-01-09T19:54:01 Last Updated: 2024-08-04T08:55:21.602Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10009 - https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers - https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-
-soon-maintenance-mode/#developers - https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/
CVE ID: CVE-2020-6167 State: PUBLISHED Published: 2020-01-09T18:09:46 Last Updated: 2024-08-04T08:55:22.160Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10007 - https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers - https://www.wordfence.com/blog/2020/01/multiple-vu
dpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers - https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/
CVE ID: CVE-2020-6168 State: PUBLISHED Published: 2020-01-09T19:58:16 Last Updated: 2024-08-04T08:55:21.954Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting). Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/10008 - https://wordpress.org/plugins/minimal-coming-soon-maintenance
References: - https://wpvulndb.com/vulnerabilities/10008 - https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers - https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/
CVE ID: CVE-2020-6170 State: PUBLISHED Published: 2020-01-08T05:30:56 Last Updated: 2024-08-04T08:55:22.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML source code of the cgi-bin/index2.asp URI. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40husinulzsanub/exploiting-router-authentication-through-web-interface-68660c708206 - http://packetstormsecurity.com/files/156075/Genexis-Platinum-4410-2.1-Authentication-Bypass.html
CVE ID: CVE-2020-6171 State: PUBLISHED Published: 2020-04-07T12:20:42 Last Updated: 2024-08-04T08:55:22.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.deepcode.ca/index.php/2020/04/07/cve-2020-xss-in-clink-office-v2/
CVE ID: CVE-2020-6173 State: PUBLISHED Published: 2020-01-14T18:50:31 Last Updated: 2024-08-04T08:55:22.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theupdateframework/tuf/commits/develop - https://github.com/theupdateframework/tuf/issues/973
CVE ID: CVE-2020-6174 State: PUBLISHED Published: 2020-02-05T15:49:15 Last Updated: 2024-08-04T08:55:22.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theupdateframework/tuf/pull/974
CVE ID: CVE-2020-6175 State: PUBLISHED Published: 2020-03-16T20:42:27 Last Updated: 2024-08-04T08:55:22.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/search - https://support.citrix.com/article/CTX263526
CVE ID: CVE-2020-6177 State: PUBLISHED Published: 2020-02-12T19:45:38 Last Updated: 2024-08-04T08:55:21.591Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP Mobile Platform Problem Types: Missing XML Validation Description: SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2880993 - https://wiki.
Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2880993 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812
CVE ID: CVE-2020-6178 State: PUBLISHED Published: 2020-03-10T20:17:39 Last Updated: 2024-08-04T08:55:22.177Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Enable Now Problem Types: Information Disclosure Description: SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2880664 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
CVE ID: CVE-2020-6181 State: PUBLISHED Published: 2020-02-12T19:46:52 Last Updated: 2024-08-04T08:55:22.112Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver (SAP Basis), SAP ABAP Platform (SAP Basis) Problem Types: HTTP Response Splitting Description: Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability. Additional Analyst Notes: - CVE Program Container: Refere
a Web user, leading to HTTP Response Splitting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2880744
CVE ID: CVE-2020-6183 State: PUBLISHED Published: 2020-02-12T19:46:34 Last Updated: 2024-08-04T08:55:22.286Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Host Agent Problem Types: Missing Authorization Check Description: SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https
ing to Missing Authorization Check vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2836445
CVE ID: CVE-2020-6184 State: PUBLISHED Published: 2020-02-12T19:46:26 Last Updated: 2024-08-04T08:55:22.128Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: Automated Note Search Tool (SAP Basis) Problem Types: Missing Authorization Check Description: Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2863397 - https
ditional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2863397 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812
CVE ID: CVE-2020-6185 State: PUBLISHED Published: 2020-02-12T19:56:20 Last Updated: 2024-08-04T08:55:22.130Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver (SAP Basis), SAP S/4HANA (SAP Basis) Problem Types: Stored Cross Site Scripting Description: Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpa
lnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2880869
CVE ID: CVE-2020-6186 State: PUBLISHED Published: 2020-02-12T19:46:43 Last Updated: 2024-08-04T08:55:21.898Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP Host Agent Problem Types: Denial of Service Description: SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2841053
CVE ID: CVE-2020-6187 State: PUBLISHED Published: 2020-02-12T19:45:46 Last Updated: 2024-08-04T08:55:21.848Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver (Guided Procedures) Problem Types: Missing XML Validation Description: SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2864415
CVE ID: CVE-2020-6188 State: PUBLISHED Published: 2020-02-12T19:46:09 Last Updated: 2024-08-04T08:55:22.007Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: SAP SE Products: SAP ERP (SAP_APPL), SAP ERP (SAP_FIN), SAP S/4 HANA (S4CORE) Problem Types: Missing Authorization Check Description: VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.sc
leading to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2857511
CVE ID: CVE-2020-6189 State: PUBLISHED Published: 2020-02-12T19:45:53 Last Updated: 2024-08-04T08:55:22.102Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (CMC) Problem Types: Information Disclosure Description: Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=53
onal Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2695210
CVE ID: CVE-2020-6190 State: PUBLISHED Published: 2020-02-12T19:46:01 Last Updated: 2024-08-04T08:55:21.916Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS Java (Heap Dump Application) Problem Types: Information Disclosure Description: Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action
re. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2838835
CVE ID: CVE-2020-6191 State: PUBLISHED Published: 2020-02-12T19:46:16 Last Updated: 2024-08-04T08:55:22.096Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Landscape Management Problem Types: Missing input validation Description: SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2878030
CVE ID: CVE-2020-6192 State: PUBLISHED Published: 2020-02-12T19:45:29 Last Updated: 2024-08-04T08:55:22.058Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Landscape Management Problem Types: Missing input validation Description: SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2877968 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812
CVE ID: CVE-2020-6193 State: PUBLISHED Published: 2020-02-12T19:45:20 Last Updated: 2024-08-04T08:55:22.129Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver (Knowledge Management ICE Service) Problem Types: Reflected Cross Site Scripting Description: SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/no
erences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 - https://launchpad.support.sap.com/#/notes/2873012
CVE ID: CVE-2020-6195 State: PUBLISHED Published: 2020-04-14T19:36:32 Last Updated: 2024-08-04T08:55:22.152Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: Information Disclosure Description: SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to read/modify delete the data and rights within the system. Additional Analyst Notes: - CVE
tive rights to the attacker to read/modify delete the data and rights within the system. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2878507 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202
CVE ID: CVE-2020-6196 State: PUBLISHED Published: 2020-03-10T20:17:46 Last Updated: 2024-08-04T08:55:22.097Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP BusinessObjects Mobile (MobileBIService) Problem Types: Denial of Service Description: SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting in a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2826782 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
CVE ID: CVE-2020-6197 State: PUBLISHED Published: 2020-03-10T20:17:58 Last Updated: 2024-08-04T08:55:22.008Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Enable Now Problem Types: Insufficient Session Expiration Description: SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for instance, to still download the portables. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 - https://launchpad.support.sap.com/#/notes/2845363
CVE ID: CVE-2020-6198 State: PUBLISHED Published: 2020-03-10T20:18:20 Last Updated: 2024-08-04T08:55:22.129Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Solution Manager (Diagnostics Agent) Problem Types: Missing Authentication Check Description: SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote functions on the Agent due to Missing Authentication Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 - https://launchpad.support.sap.com/
References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 - https://launchpad.support.sap.com/#/notes/2845377
CVE ID: CVE-2020-6199 State: PUBLISHED Published: 2020-03-10T20:18:38 Last Updated: 2024-08-04T08:55:22.062Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP ERP (EAPPGLO), SAP ERP (SAP_FIN), SAP S/4HANA (S4CORE) Problem Types: Missing Authorization Check Description: The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization C
hich an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 - https://launchpad.support.sap.com/#/notes/2871167
CVE ID: CVE-2020-6200 State: PUBLISHED Published: 2020-03-10T20:18:50 Last Updated: 2024-08-04T08:55:21.904Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Commerce Cloud (SmartEdit Extension) Problem Types: Cross-Site-Scripting Description: The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 - https://launchpad.support.sap