Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-6288 State: PUBLISHED Published: 2020-09-09T12:52:41 Last Updated: 2024-08-04T08:55:22.418Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: CWE-434 Description: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is
e with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://launchpad.support.sap.com/#/notes/2930128
CVE ID: CVE-2020-6289 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.240Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Cross-Site Request Forgery Description: SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2758000
CVE ID: CVE-2020-6290 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.403Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Session Fixation Description: SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2758000
CVE ID: CVE-2020-6291 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.208Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Insufficient Session Expiration Description: SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2758000
CVE ID: CVE-2020-6292 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.252Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: CWE-613 Description: Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2758000
CVE ID: CVE-2020-6293 State: PUBLISHED Published: 2020-08-12T13:22:41 Last Updated: 2024-08-04T08:55:22.260Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP NetWeaver (Knowledge Management) Problem Types: Unrestricted File Upload Description: SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access control lists and other upload file size restrictions, leading to Unrestricted File Upload. Additional Ana
uch as access control lists and other upload file size restrictions, leading to Unrestricted File Upload. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2938162
CVE ID: CVE-2020-6294 State: PUBLISHED Published: 2020-08-12T13:27:19 Last Updated: 2024-08-04T08:55:22.318Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: Missing Authentication Check Description: Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2927956
CVE ID: CVE-2020-6295 State: PUBLISHED Published: 2020-08-12T13:28:28 Last Updated: 2024-08-04T08:55:22.195Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Adaptive Server Enterprise Problem Types: Information Disclosure Description: Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information through publicly readable installation log files leading to a compromise of the installed Cockpit. This compromise could enable the attacker to view, modify and/or make unavailable any data associated with the Cockpit, leading to Information Disclosure. Additio
to view, modify and/or make unavailable any data associated with the Cockpit, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2941332
CVE ID: CVE-2020-6296 State: PUBLISHED Published: 2020-08-12T13:34:40 Last Updated: 2024-08-04T08:55:22.230Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver (ABAP Server) and ABAP Platform Problem Types: Code Injection Description: SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?p
. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2941667
CVE ID: CVE-2020-6297 State: PUBLISHED Published: 2020-08-12T13:35:46 Last Updated: 2024-08-04T08:55:22.435Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: SAP SE Products: SAP Data Intelligence Problem Types: Information Disclosure Description: Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential system configuration information, that should otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/n
ferences: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2940823
CVE ID: CVE-2020-6298 State: PUBLISHED Published: 2020-08-12T13:41:55 Last Updated: 2024-08-04T08:55:22.280Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: SAP SE Products: SAP Banking Services (Generic Market Data) Problem Types: Missing Authorization Check Description: SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GMD) and change related GMD key figure values, due to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.s
gram Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2939685
CVE ID: CVE-2020-6299 State: PUBLISHED Published: 2020-08-12T13:43:57 Last Updated: 2024-08-04T08:55:22.302Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver (ABAP Server) and ABAP Platform Problem Types: Information Disclosure Description: SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value help, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/
ces: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2941510
CVE ID: CVE-2020-6300 State: PUBLISHED Published: 2020-08-12T13:45:02 Last Updated: 2024-08-04T08:55:22.278Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (Central Management Console) Problem Types: Cross Site Scripting Description: SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user (victim), as it does not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS) vulnerabi
not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2925827
CVE ID: CVE-2020-6301 State: PUBLISHED Published: 2020-08-12T13:50:55 Last Updated: 2024-08-04T08:55:22.415Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP SE Products: SAP ERP (HCM Travel Management) Problem Types: Missing Authorization check Description: SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support
ontainer: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2949196
CVE ID: CVE-2020-6302 State: PUBLISHED Published: 2020-09-09T12:52:14 Last Updated: 2024-08-04T08:55:22.407Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Commerce Problem Types: CWE-384 Description: SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Cont
mise of the confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://launchpad.support.sap.com/#/notes/2934451
CVE ID: CVE-2020-6303 State: PUBLISHED Published: 2020-01-14T17:52:59 Last Updated: 2024-08-04T08:55:22.413Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: Improper Input Validation Description: SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2772325 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771
CVE ID: CVE-2020-6304 State: PUBLISHED Published: 2020-01-14T17:52:59 Last Updated: 2024-08-04T08:55:22.294Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver Internet Communication Manager (KRNL32NUC), SAP NetWeaver Internet Communication Manager (KRNL32UC), SAP NetWeaver Internet Communication Manager (KRNL64NUC), SAP NetWeaver Internet Communication Manager (KRNL64UC), SAP NetWeaver Internet Communication Manager (KERNEL) Problem Types: Improper Input Validation Description: Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC
etWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 - https://launchpad.support.sap.com/#/notes/2848498
CVE ID: CVE-2020-6305 State: PUBLISHED Published: 2020-01-14T17:52:59 Last Updated: 2024-08-04T08:55:22.450Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Process Integration - Rest Adapter (SAP_XIAF) Problem Types: Cross-Site Scripting Description: PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 - https://launchpad.support.sap.com/#/notes/2863743
CVE ID: CVE-2020-6306 State: PUBLISHED Published: 2020-01-14T17:52:59 Last Updated: 2024-08-04T08:55:22.446Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP SE Products: SAP Leasing (SAP_Appl), SAP Leasing (EA_Appl) Problem Types: Missing Authorization Check Description: Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 - https://launchpad.support.sap.com/#/notes/2865348
CVE ID: CVE-2020-6307 State: PUBLISHED Published: 2020-01-14T17:52:59 Last Updated: 2024-08-04T08:55:22.405Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: Automated Note Search Tool (SAP Basis) Problem Types: Missing Authorization Check Description: Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 - https://launchpad.support.sap.com/#/notes/2863
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 - https://launchpad.support.sap.com/#/notes/2863397
CVE ID: CVE-2020-6308 State: PUBLISHED Published: 2020-10-20T13:31:10 Last Updated: 2024-08-04T08:55:22.240Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Services) Problem Types: Server-Side Request Forgery Description: SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gathe
xternally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - https://launchpad.support.sap.com/#/notes/2943844
CVE ID: CVE-2020-6309 State: PUBLISHED Published: 2020-08-12T13:51:59 Last Updated: 2024-08-04T08:55:22.249Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (ENGINEAPI), SAP NetWeaver AS JAVA (WSRM), SAP NetWeaver AS JAVA (J2EE-FRMW) Problem Types: Missing Authentication check Description: SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service. Additional Analyst Notes: - CVE Program Container: References: - h
l payloads and leading to complete denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2941315
CVE ID: CVE-2020-6310 State: PUBLISHED Published: 2020-08-12T13:52:51 Last Updated: 2024-08-04T08:55:22.287Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver (ABAP Server) and ABAP Platform Problem Types: Information Disclosure Description: Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.s
gram Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2944988
CVE ID: CVE-2020-6311 State: PUBLISHED Published: 2020-09-09T13:12:47 Last Updated: 2024-08-04T08:55:22.265Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: BANKING SERVICES FROM SAP 9.0(Bank Analyzer), S/4HANA FIN PROD SUBLDGR Problem Types: CWE-285 Description: Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform necessary authorization checks for an authenticated user due to Improper Authorization checks, that may cause a system administrator to create incorrect authorization proposals. This may result in privilege escalation and may expos
system administrator to create incorrect authorization proposals. This may result in privilege escalation and may expose restricted banking data. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://launchpad.support.sap.com/#/notes/2951325
CVE ID: CVE-2020-6312 State: PUBLISHED Published: 2020-09-09T12:40:12 Last Updated: 2024-08-04T08:55:22.413Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) Problem Types: Cross Site Scripting Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site Scripting. In certain situations, when a user accesses an af
sses particular page elements, leading to stored Cross Site Scripting. In certain situations, when a user accesses an affected web page element, the attacker will be able to access or modify metadata for which they are not authorized. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://launchpad.support.sap.com/#/notes/2930128
CVE ID: CVE-2020-6313 State: PUBLISHED Published: 2020-09-09T12:43:03 Last Updated: 2024-08-04T08:55:22.450Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (XML Forms) Problem Types: Cross Site Scripting Description: SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - h
g JavaScript, leading to Stored Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://launchpad.support.sap.com/#/notes/2953112
CVE ID: CVE-2020-6314 State: PUBLISHED Published: 2020-09-09T12:41:25 Last Updated: 2024-08-04T08:55:22.489Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Improper Input Validation Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/29608
dation. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2960815 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://www.zerodayinitiative.com/advisories/ZDI-20-1141/
CVE ID: CVE-2020-6315 State: PUBLISHED Published: 2020-10-20T13:26:23 Last Updated: 2024-08-04T08:55:22.380Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: Information Disclosure Description: SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of sensitive information when the victim loads the malicious file into the VE viewer, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - https://launchp
Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - https://launchpad.support.sap.com/#/notes/2973497