Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24847 State: PUBLISHED Published: 2025-11-11T16:49:59.013Z Last Updated: 2025-11-12T21:23:29.533Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) CIP software Problem Types: Information Disclosure, CWE-20 Description: Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are present without special internal knowledge an
sult may potentially occur via network access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html
CVE ID: CVE-2025-24848 State: PUBLISHED Published: 2025-11-11T16:50:00.700Z Last Updated: 2025-11-13T04:55:22.278Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) CIP software Problem Types: Escalation of Privilege, CWE-693 Description: Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special intern
rivilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html
CVE ID: CVE-2025-24849 State: PUBLISHED Published: 2025-02-28T16:58:55.473Z Last Updated: 2025-02-28T21:50:19.286Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dario Health Products: USB-C Blood Glucose Monitoring System Starter Kit Android Applications, Dario Application Database and Internet-based Server Infrastructure Problem Types: CWE-319 Description: Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01 - https://www.dariohealth.com/contact/
CVE ID: CVE-2025-24850 State: PUBLISHED Published: 2025-04-15T21:33:05.892Z Last Updated: 2025-04-16T14:42:11.964Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An attacker can export other users' plant information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-24852 State: PUBLISHED Published: 2025-03-31T04:49:07.988Z Last Updated: 2025-03-31T16:02:38.648Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Inaba Denki Sangyo Co., Ltd. Products: CHOCO TEI WATCHER mini (IB-MCT001) Problem Types: CWE-257 Description: Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/files/chocomini_vulnerability.pdf - https://jvn.jp/en/vu/JVNVU9115
P Vulnrichment: References: - https://www.inaba.co.jp/files/chocomini_vulnerability.pdf - https://jvn.jp/en/vu/JVNVU91154745/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-04 - https://www.nozominetworks.com/blog/unpatched-vulnerabilities-in-production-line-cameras-may-allow-remote-surveillance-hinder-stoppage-recording
CVE ID: CVE-2025-24853 State: PUBLISHED Published: 2025-07-31T08:42:06.453Z Last Updated: 2025-11-04T21:09:43.620Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: CWE-79 Description: A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jspwiki-wiki.apac
ter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853
CVE ID: CVE-2025-24854 State: PUBLISHED Published: 2025-07-31T08:43:18.886Z Last Updated: 2025-11-04T21:09:44.925Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: CWE-79 Description: A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854
CVE ID: CVE-2025-24855 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-11-03T21:12:46.184Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: xmlsoft Products: libxslt Problem Types: CWE-416 Description: numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxslt/-/issues/128
CVE ID: CVE-2025-24856 State: PUBLISHED Published: 2025-03-16T00:00:00.000Z Last Updated: 2025-03-17T15:44:18.669Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C) Vendors: TYPO3 Products: oidc Problem Types: CWE-348 Description: An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: (1) an attacker can anticipate the e-mail address of the user, (2) an attacker can register a public frontend user account using that e-mail address before the user's f
s of the user, (2) an attacker can register a public frontend user account using that e-mail address before the user's first OIDC login, and (3) the IDP returns an email field containing the e-mail address of the user, Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-001 - https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3
CVE ID: CVE-2025-24858 State: PUBLISHED Published: 2025-01-26T00:00:00.000Z Last Updated: 2025-02-12T20:01:14.275Z Vendors: Gradle Products: Enterprise Problem Types: CWE-201 Description: Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password. Ad
a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gradle.com/advisory/2025-01
CVE ID: CVE-2025-24859 State: PUBLISHED Published: 2025-04-14T08:18:54.729Z Last Updated: 2025-04-18T15:26:06.137Z Vendors: Apache Software Foundation Products: Apache Roller Problem Types: CWE-613 Description: A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apach
ter password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23 - https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f
CVE ID: CVE-2025-24860 State: PUBLISHED Published: 2025-02-04T10:17:55.258Z Last Updated: 2025-02-15T00:10:37.682Z Vendors: Apache Software Foundation Products: Apache Cassandra Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer. Users with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions. This issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 t
pache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer. Operators using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/yjo5on4tf7s1r9qklc4byrz30b8vkm2d
CVE ID: CVE-2025-24861 State: PUBLISHED Published: 2025-02-13T21:20:05.837Z Last Updated: 2025-02-14T15:47:37.776Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Outback Power Products: Mojave Inverter Problem Types: CWE-77 Description: An attacker may inject commands via specially-crafted post requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-17 - https://old.outbackpower.com/about-outback/contact/contact-us
CVE ID: CVE-2025-24862 State: PUBLISHED Published: 2025-11-11T16:50:04.395Z Last Updated: 2025-11-14T04:55:26.267Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: Intel(R) CIP software Problem Types: Escalation of Privilege, CWE-434 Description: Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via network access when attack requirements are present with special
ata manipulation. This result may potentially occur via network access when attack requirements are present with special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html
CVE ID: CVE-2025-24863 State: PUBLISHED Published: 2025-11-11T16:50:06.433Z Last Updated: 2025-11-14T17:38:13.192Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) CIP software Problem Types: Information Disclosure, CWE-269 Description: Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are present without special internal kno
. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html
CVE ID: CVE-2025-24864 State: PUBLISHED Published: 2025-03-06T03:55:58.186Z Last Updated: 2025-03-06T15:22:27.280Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: RSUPPORT Co.,Ltd. Products: RemoteView Agent (for Windows) Problem Types: CWE-276 Description: Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.rview.com/hc/ja/articles/38287019277843-%E7%B7%8A%E6%80%A5%E3%83%
s: - CISA ADP Vulnrichment: References: - https://help.rview.com/hc/ja/articles/38287019277843-%E7%B7%8A%E6%80%A5%E3%83%91%E3%83%83%E3%83%81%E4%BD%9C%E6%A5%AD%E3%81%AE%E3%81%94%E6%A1%88%E5%86%85-2025-02-13-%E5%AE%8C%E4%BA%86 - https://jvn.jp/en/jp/JVN24992507/
CVE ID: CVE-2025-24865 State: PUBLISHED Published: 2025-02-13T21:29:23.438Z Last Updated: 2025-02-14T15:47:26.772Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Manager Problem Types: CWE-306 Description: The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16 - https://www.myscada.org/downloads/mySCADAPROManager/ - https://www.myscada.org/c
-events/ics-advisories/icsa-25-044-16 - https://www.myscada.org/downloads/mySCADAPROManager/ - https://www.myscada.org/contacts/
CVE ID: CVE-2025-24866 State: PUBLISHED Published: 2025-04-10T15:33:21.882Z Last Updated: 2025-04-10T15:43:54.351Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-24867 State: PUBLISHED Published: 2025-02-11T00:35:34.021Z Last Updated: 2025-02-11T15:58:14.220Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Platform (BI Launchpad) Problem Types: CWE-79 Description: SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify inform
cks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3445708 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24868 State: PUBLISHED Published: 2025-02-11T00:35:42.925Z Last Updated: 2025-02-11T15:55:57.581Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP HANA extended application services, advanced model (User Account and Authentication Services) Problem Types: CWE-601 Description: The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker
directs the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3563929 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24869 State: PUBLISHED Published: 2025-02-11T00:36:51.926Z Last Updated: 2025-02-18T18:07:04.307Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server Java Problem Types: CWE-863 Description: SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information co
L files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3550027 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24870 State: PUBLISHED Published: 2025-02-11T00:37:05.969Z Last Updated: 2025-02-18T18:06:30.865Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP GUI for Windows Problem Types: CWE-921 Description: SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.
impact on integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3562336 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24872 State: PUBLISHED Published: 2025-02-11T00:37:14.780Z Last Updated: 2025-02-18T18:06:00.780Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP ABAP Platform (ABAP Build Framework) Problem Types: CWE-863 Description: The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact on the confidentiality of the application with no effect on the integrity and availability of the application.
d impact on the confidentiality of the application with no effect on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3553753 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24874 State: PUBLISHED Published: 2025-02-11T00:37:22.842Z Last Updated: 2025-02-18T18:05:26.373Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Commerce (Backoffice) Problem Types: CWE-1021 Description: SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information. Additional Analyst Notes:
g could become possible then, and lead to exposure and modification of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3559510 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24875 State: PUBLISHED Published: 2025-02-11T00:37:32.280Z Last Updated: 2025-02-18T18:05:00.986Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Commerce Problem Types: CWE-352 Description: SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3555364 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-24876 State: PUBLISHED Published: 2025-02-11T00:37:40.988Z Last Updated: 2025-02-21T16:46:32.934Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: SAP Approuter Node.js package Problem Types: CWE-1287, CWE-302 Description: The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3567974 - https://www.npmjs.com/pac
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3567974 - https://www.npmjs.com/package/@sap/approuter?activeTab=versions - https://url.sap/sapsecuritypatchday