Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-0345 State: PUBLISHED Published: 2019-08-14T13:54:04 Last Updated: 2024-08-04T17:44:16.475Z Vendors: SAP SE Products: SAP NetWeaver Application Server for Java (Administrator System Overview) Problem Types: Server-Side Request Forgery Description: A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery. Additional Analyst Notes: - CVE Program Container: References: - https://wi
e, resulting in Server-Side Request Forgery. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2813811
CVE ID: CVE-2019-0346 State: PUBLISHED Published: 2019-08-14T13:54:58 Last Updated: 2024-08-04T17:44:16.560Z Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (CMC) Problem Types: Information Disclosure Description: Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2764513
CVE ID: CVE-2019-0348 State: PUBLISHED Published: 2019-08-14T13:55:54 Last Updated: 2024-08-04T17:44:16.472Z Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (Web Intelligence) Problem Types: Information Disclosure Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2751470
CVE ID: CVE-2019-0349 State: PUBLISHED Published: 2019-08-14T14:54:52 Last Updated: 2024-08-04T17:44:16.482Z Vendors: SAP SE Products: SAP Kernel (KRNL32NUC), SAP Kernel (KRNL32UC), SAP Kernel (KRNL64NUC), SAP Kernel (KRNL64UC), SAP Kernel (KERNEL) Problem Types: Missing Authorization Check Description: SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorizatio
to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2798743
CVE ID: CVE-2019-0350 State: PUBLISHED Published: 2019-11-04T14:33:20 Last Updated: 2024-08-04T17:44:16.493Z Vendors: SAP SE Products: SAP HANA Database Problem Types: Denial of Service Description: SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2798243
CVE ID: CVE-2019-0351 State: PUBLISHED Published: 2019-08-14T13:57:00 Last Updated: 2024-08-04T17:44:16.464Z Vendors: SAP SE Products: SAP NetWeaver UDDI Server (Services Registry) Problem Types: others Description: A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this, an attacker can exploit Services Registry potentially enabling them to take complete control of the product, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the pr
is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 - https://launchpad.support.sap.com/#/notes/2800779
CVE ID: CVE-2019-0352 State: PUBLISHED Published: 2019-09-10T16:03:38 Last Updated: 2024-08-04T17:44:16.501Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (CMC) Problem Types: Other Description: In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2735924 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
CVE ID: CVE-2019-0353 State: PUBLISHED Published: 2019-09-10T16:05:23 Last Updated: 2024-08-04T17:44:16.539Z Vendors: SAP SE Products: SAP Business One Client Problem Types: Information Disclosure Description: Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2768864
CVE ID: CVE-2019-0355 State: PUBLISHED Published: 2019-09-10T16:07:10 Last Updated: 2024-08-04T17:44:16.479Z Vendors: SAP SE Products: SAP NetWeaver AS for Java (Web Container)-ENGINEAPI, SAP NetWeaver AS for Java (Web Container)-SAP-JEECOR Problem Types: Code Injection Description: SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpa
application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2798336
CVE ID: CVE-2019-0356 State: PUBLISHED Published: 2019-09-10T16:27:52 Last Updated: 2024-08-04T17:44:16.494Z Vendors: SAP SE Products: SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF Problem Types: Information Disclosure Description: Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2802521
CVE ID: CVE-2019-0357 State: PUBLISHED Published: 2019-09-10T16:48:14 Last Updated: 2024-08-04T17:44:16.461Z Vendors: SAP SE Products: SAP HANA Problem Types: Missing Authorization Check Description: The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2829681
CVE ID: CVE-2019-0361 State: PUBLISHED Published: 2019-09-10T16:09:25 Last Updated: 2024-08-04T17:44:16.592Z Vendors: SAP SE Products: SAP Supplier Relationship Management (Master Data Management Catalog) (SRM_MDM_CAT) Problem Types: Cross-Site Scripting Description: SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2820607
CVE ID: CVE-2019-0363 State: PUBLISHED Published: 2019-09-10T16:11:19 Last Updated: 2024-08-04T17:44:16.529Z Vendors: SAP SE Products: SAP HANA Extended Application Services Problem Types: Denial of Service Description: Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrieve information about internal network ports. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2817491
CVE ID: CVE-2019-0364 State: PUBLISHED Published: 2019-09-10T16:13:22 Last Updated: 2024-08-04T17:44:16.544Z Vendors: SAP SE Products: SAP HANA Extended Application Services Problem Types: Other Description: Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2817491
CVE ID: CVE-2019-0365 State: PUBLISHED Published: 2019-09-10T16:15:26 Last Updated: 2024-08-04T17:44:16.488Z Vendors: SAP SE Products: SAP Kernel (KRNL32NUC), SAP Kernel (KRNL32UC), SAP Kernel (KRNL64NUC), SAP Kernel (KRNL64UC), SAP Kernel (KERNEL), SAP GUI for Windows (BC-FES-GUI), SAP GUI for Java (BC-FES-JAV) Problem Types: Denial of Service Description: SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow
SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 - https://launchpad.support.sap.com/#/notes/2786151
CVE ID: CVE-2019-0367 State: PUBLISHED Published: 2019-10-08T19:16:25 Last Updated: 2024-08-04T17:44:16.518Z Vendors: SAP SE Products: SAP NetWeaver Process Integration (B2B Toolkit) Problem Types: Missing Authorization Check Description: SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2805777 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050
CVE ID: CVE-2019-0368 State: PUBLISHED Published: 2019-10-08T19:17:44 Last Updated: 2024-08-04T17:44:16.523Z Vendors: SAP SE Products: SAP Customer Relationship Management (Email Management - S4CRM), SAP Customer Relationship Management (Email Management - BBPCRM) Problem Types: Cross-Site Scripting Description: SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?
y. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2751806
CVE ID: CVE-2019-0369 State: PUBLISHED Published: 2019-10-08T19:19:11 Last Updated: 2024-08-04T17:51:26.111Z Vendors: SAP SE Products: SAP Financial Consolidation Problem Types: Cross-Site Scripting Description: SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to reflected cross site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2806403
CVE ID: CVE-2019-0370 State: PUBLISHED Published: 2019-10-08T19:20:08 Last Updated: 2024-08-04T17:51:26.086Z Vendors: SAP SE Products: SAP Financial Consolidation Problem Types: Others Description: Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2806403
CVE ID: CVE-2019-0374 State: PUBLISHED Published: 2019-10-08T19:21:30 Last Updated: 2024-08-04T17:51:26.119Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com
: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2817945
CVE ID: CVE-2019-0375 State: PUBLISHED Published: 2019-10-08T19:22:26 Last Updated: 2024-08-04T17:51:26.129Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https:/
s: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2817945
CVE ID: CVE-2019-0376 State: PUBLISHED Published: 2019-10-08T19:23:56 Last Updated: 2024-08-04T17:51:26.103Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/view
ite Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2817945
CVE ID: CVE-2019-0377 State: PUBLISHED Published: 2019-10-08T19:24:50 Last Updated: 2024-08-04T17:51:26.707Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.sup
am Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2817945
CVE ID: CVE-2019-0378 State: PUBLISHED Published: 2019-10-08T19:25:44 Last Updated: 2024-08-04T17:51:26.339Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross-Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - http
otes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2817945
CVE ID: CVE-2019-0379 State: PUBLISHED Published: 2019-10-08T19:27:11 Last Updated: 2024-08-04T17:51:26.085Z Vendors: SAP SE Products: SAP Process Integration, business-to-business add-on Problem Types: Missing Authentication Check Description: SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle (BC), leading to Missing Authentication Check Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2826015
CVE ID: CVE-2019-0380 State: PUBLISHED Published: 2019-10-08T19:31:03 Last Updated: 2024-08-04T17:51:26.927Z Vendors: SAP SE Products: SAP Landscape Management enterprise edition Problem Types: Information Disclosure Description: Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2828682
CVE ID: CVE-2019-0381 State: PUBLISHED Published: 2019-10-08T19:29:26 Last Updated: 2024-08-04T17:51:26.765Z Vendors: SAP SE Products: SAP IQ, SAP SQL Anywhere, SAP Dynamic Tiering Problem Types: Other Description: A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 - https://launchpad.support.sap.com/#/notes/2792430
CVE ID: CVE-2019-0382 State: PUBLISHED Published: 2019-11-13T21:59:11 Last Updated: 2024-08-04T17:51:26.301Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Problem Types: Cross-Site Scripting Description: A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2. Privileges are required in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 - https://launchpad.support.sap.com/#/notes/2817937
CVE ID: CVE-2019-0383 State: PUBLISHED Published: 2019-12-17T19:21:56 Last Updated: 2024-08-04T17:51:26.142Z Vendors: SAP SE Products: SAP Treasury and Risk Management (S4CORE), SAP Treasury and Risk Management (EA-FINSERV) Problem Types: Missing Authorization Check Description: Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2819170 - h
. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2819170 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390
CVE ID: CVE-2019-0384 State: PUBLISHED Published: 2019-12-17T19:24:06 Last Updated: 2024-08-04T17:51:27.032Z Vendors: SAP SE Products: SAP Treasury and Risk Management (S4CORE), SAP Treasury and Risk Management (EA-FINSERV) Problem Types: Missing Authorization Check Description: Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 -
st Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 - https://launchpad.support.sap.com/#/notes/2828981
CVE ID: CVE-2019-0385 State: PUBLISHED Published: 2019-11-13T21:57:40 Last Updated: 2024-08-04T17:51:26.061Z Vendors: SAP SE Products: SAP Enable Now Problem Types: Cross-Site Scripting Description: SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2833771 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390
CVE ID: CVE-2019-0386 State: PUBLISHED Published: 2019-11-13T22:18:40 Last Updated: 2024-08-04T17:51:26.373Z Vendors: SAP SE Products: SAP ERP Sales (SAP_APPL), S4HANA Sales (S4CORE) Problem Types: Missing Authorization Check Description: Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 - https://launchpad.sup
am Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 - https://launchpad.support.sap.com/#/notes/2840520