Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
VE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2879132
CVE ID: CVE-2020-6227 State: PUBLISHED Published: 2020-04-14T18:19:57 Last Updated: 2024-08-04T08:55:22.281Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (CMS / Auditing issues) Problem Types: Improper Input Validation Description: SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpag
log files. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2863396
CVE ID: CVE-2020-6228 State: PUBLISHED Published: 2020-04-14T18:32:25 Last Updated: 2024-08-04T08:55:22.286Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: SAP SE Products: SAP Business Client Problem Types: Other Description: SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify the installer. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2866752
CVE ID: CVE-2020-6229 State: PUBLISHED Published: 2020-04-14T18:20:21 Last Updated: 2024-08-04T08:55:22.172Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME) Problem Types: Cross Site Scripting Description: SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not sufficiently encode user controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/w
ripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2900374
CVE ID: CVE-2020-6230 State: PUBLISHED Published: 2020-04-14T18:34:07 Last Updated: 2024-08-04T08:55:22.267Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP OrientDB Problem Types: Code Injection Description: SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2900118
CVE ID: CVE-2020-6231 State: PUBLISHED Published: 2020-04-14T18:32:57 Last Updated: 2024-08-04T08:55:22.155Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross Site Scripting Description: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launc
CVE ID: CVE-2020-6232 State: PUBLISHED Published: 2020-04-14T18:37:46 Last Updated: 2024-08-04T08:55:22.406Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Commerce Problem Types: Missing Authorization Check Description: SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects confidentiality of secure media. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2888556
CVE ID: CVE-2020-6233 State: PUBLISHED Published: 2020-04-14T18:34:47 Last Updated: 2024-08-04T08:55:22.311Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL), SAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL) Problem Types: Missing Authorization Check Description: SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analysis report due to Missing Authorization Check, resulting in slowing the system. Additional Analyst Notes: - CVE Program Container
t due to Missing Authorization Check, resulting in slowing the system. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2904796
CVE ID: CVE-2020-6234 State: PUBLISHED Published: 2020-04-14T18:38:12 Last Updated: 2024-08-04T08:55:22.159Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Host Agent Problem Types: Privilege Escalation Description: SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating system, leading to Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2902645 - http://seclists.org/fulldisclosure/2021/Apr/5
ion?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2902645 - http://seclists.org/fulldisclosure/2021/Apr/5 - http://packetstormsecurity.com/files/162084/SAP-Host-Control-Local-Privilege-Escalation.html
CVE ID: CVE-2020-6235 State: PUBLISHED Published: 2020-04-14T18:36:26 Last Updated: 2024-08-04T08:55:22.266Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Solution Manager (Diagnostics Agent) Problem Types: Missing authentication Description: SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to Missing Authentication. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2906994
CVE ID: CVE-2020-6236 State: PUBLISHED Published: 2020-04-14T18:38:43 Last Updated: 2024-08-04T08:55:22.273Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Landscape Management, SAP Adaptive Extensions Problem Types: Privilege Escalation Description: SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation. Additional Analyst Notes: - CVE Program Cont
iles as root user from a non-root context, leading to Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2902456
CVE ID: CVE-2020-6237 State: PUBLISHED Published: 2020-04-14T18:36:58 Last Updated: 2024-08-04T08:55:22.178Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: Information Disclosure Description: Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.s
gram Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2898077
CVE ID: CVE-2020-6238 State: PUBLISHED Published: 2020-04-14T18:39:02 Last Updated: 2024-08-04T08:55:22.193Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: SAP SE Products: SAP Commerce Problem Types: Missing XML Validation Description: SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 - https://launchpad.support.sap.com/#/notes/2904480
CVE ID: CVE-2020-6239 State: PUBLISHED Published: 2020-06-10T12:33:30 Last Updated: 2024-08-04T08:55:22.312Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Business One (Backup service) Problem Types: Information Disclosure Description: Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2908382
CVE ID: CVE-2020-6240 State: PUBLISHED Published: 2020-05-12T17:46:58 Last Updated: 2024-08-04T08:55:22.180Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI), SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS) Problem Types: Denial of Service Description: SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service Additional Analyst Notes: - CVE Program Container: References: - ht
or flooding the service leading to Denial of Service Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2856923 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
CVE ID: CVE-2020-6241 State: PUBLISHED Published: 2020-05-12T17:56:40 Last Updated: 2024-08-04T08:55:22.162Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise Problem Types: SQL Injection Description: SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2916927
CVE ID: CVE-2020-6242 State: PUBLISHED Published: 2020-05-12T17:58:06 Last Updated: 2024-08-04T08:55:22.174Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (Live Data Connect) Problem Types: Missing Authentication Check Description: SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check. Additional Analyst Notes: - CVE Program Con
ted with some specific certificate, leading to Missing Authentication Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2885244 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
CVE ID: CVE-2020-6243 State: PUBLISHED Published: 2020-05-12T17:47:46 Last Updated: 2024-08-04T08:55:22.168Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise (XP Server on Windows Platform) Problem Types: Code Injection Description: Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection. Additional Analyst Notes: - CVE Program Container: Referen
tricted data on connected servers, leading to Code Injection. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2915585 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
CVE ID: CVE-2020-6244 State: PUBLISHED Published: 2020-05-12T17:54:36 Last Updated: 2024-08-04T08:55:22.319Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business Client Problem Types: CWE-427 Description: SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=54539
l Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2911801
CVE ID: CVE-2020-6245 State: PUBLISHED Published: 2020-05-12T17:49:07 Last Updated: 2024-08-04T08:55:22.271Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: CWE-99 Description: SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes
nces: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2828558
CVE ID: CVE-2020-6246 State: PUBLISHED Published: 2020-06-10T12:34:37 Last Updated: 2024-08-04T08:55:22.287Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_TABLE) Problem Types: Cross Site Scripting Description: SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpag
nerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2878935
CVE ID: CVE-2020-6247 State: PUBLISHED Published: 2020-05-12T17:49:28 Last Updated: 2024-08-04T08:55:22.161Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: Denial of Service Description: SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/v
tem availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2828558
CVE ID: CVE-2020-6248 State: PUBLISHED Published: 2020-05-12T17:50:57 Last Updated: 2024-08-04T08:55:22.251Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise (Backup Server) Problem Types: Code Injection Description: SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/n
ferences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2917275
CVE ID: CVE-2020-6249 State: PUBLISHED Published: 2020-05-12T17:48:30 Last Updated: 2024-08-04T08:55:22.176Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Master Data Governance (S4CORE), SAP Master Data Governance (S4FND), SAP Master Data Governance (SAP_BS_FND) Problem Types: SQL Injection Description: The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/p
ading to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2908560
CVE ID: CVE-2020-6250 State: PUBLISHED Published: 2020-05-12T17:52:19 Last Updated: 2024-08-04T08:55:22.282Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise Problem Types: Information Disclosure Description: SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop the server like an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.sc
stop the server like an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2917022
CVE ID: CVE-2020-6251 State: PUBLISHED Published: 2020-05-12T17:50:16 Last Updated: 2024-08-04T08:55:22.168Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: Information Disclosure Description: Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2828558
CVE ID: CVE-2020-6252 State: PUBLISHED Published: 2020-05-12T17:55:34 Last Updated: 2024-08-04T08:55:22.304Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise (Cockpit) Problem Types: Information Disclosure Description: Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact system availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sa
ata and impact system availability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2917090
CVE ID: CVE-2020-6253 State: PUBLISHED Published: 2020-05-12T17:55:06 Last Updated: 2024-08-04T08:55:22.324Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise (Web Services) Problem Types: SQL Injection Description: Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries to elevate their privileges, modify database objects, or execute commands they are not otherwise authorized to execute, leading to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/
to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2917273
CVE ID: CVE-2020-6254 State: PUBLISHED Published: 2020-05-12T17:57:06 Last Updated: 2024-08-04T08:55:22.174Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Enterprise Threat Detection Problem Types: Cross Site Scripting Description: SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2913293
CVE ID: CVE-2020-6256 State: PUBLISHED Published: 2020-05-12T17:51:22 Last Updated: 2024-08-04T08:55:22.211Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP SE Products: SAP Master Data Governance Problem Types: Missing Authorization Check Description: SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required authorizations, due to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2912747