deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36939
Published: 2023-07-10
Description: Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the search booking field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40ridheshgohil1092/cve-2023-36939-xss-online-security-guards-hiring-system-7547ee114134; https://packetstormsecurity.com; https://medium.com/%40ridheshgohil1092/cve-2023-36939-xss-online-security-guards-hiring-system-7547ee114134
CVE: CVE-2023-36940
Published: 2023-07-10
Description: Cross Site Scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL v.1.2 allows attackers to execute arbitrary code via a crafted payload injected into the search field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40ridheshgohil1092/cve-2023-36940-xss-on-online-fire-reporting-system-v-1-2-1d3fa170e4d6; https://packetstormsecurity.com; https://medium.com/%40ridheshgohil1092/cve-2023-36940-xss-on-online-fire-reporting-system-v-1-2-1d3fa170e4d6
CVE: CVE-2023-3599
Published: 2023-07-10
Description: A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function save_user of the file admin_class.php of the component Add User Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-233450 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: https://github.com/movonow/demo/blob/main/click_fees.md; https://vuldb.com/?ctiid.233450; https://vuldb.com/?id.233450
CVE: CVE-2023-34347
Published: 2023-07-10
Description: 


​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely execute arbitrary code. 




CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01
CVE: CVE-2023-30765
Published: 2023-07-10
Description: ​Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01
CVE: CVE-2023-34316
Published: 2023-07-10
Description: ​An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-01
CVE: CVE-2023-3605
Published: 2023-07-10
Description: A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Registration Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-233467.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://vuldb.com/?ctiid.233467; https://vuldb.com/?id.233467; https://vuldb.com/?ctiid.233467
CVE: CVE-2023-22835
Published: 2023-07-10
Description: A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in an Issue that caused loss of frontend functionality to all issue participants.

This defect was resolved with the release of Foundry Issues 2.510.0 and Foundry Frontend 6.228.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20
References: https://palantir.safebase.us/?tcuUid=0e2e79bd-cc03-42a8-92c2-c0e68a1ea53d; https://palantir.safebase.us/?tcuUid=0e2e79bd-cc03-42a8-92c2-c0e68a1ea53d
CVE: CVE-2023-24486
Published: 2023-07-10
Description: A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which the ICA session is launched.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.citrix.com/article/CTX477618/citrix-workspace-app-for-linux-security-bulletin-for-cve202324486; https://support.citrix.com/article/CTX477618/citrix-workspace-app-for-linux-security-bulletin-for-cve202324486
CVE: CVE-2023-24487
Published: 2023-07-10
Description: Arbitrary file read in Citrix ADC and Citrix Gateway 
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-253
References: https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488; https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488
CVE: CVE-2023-24488
Published: 2023-07-10
Description: Cross site scripting vulnerability in Citrix ADC and Citrix Gateway  in allows and attacker to perform cross site scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488; https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488
CVE: CVE-2023-34432
Published: 2023-07-10
Description: A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2023-34432; https://bugzilla.redhat.com/show_bug.cgi?id=2212291; https://access.redhat.com/security/cve/CVE-2023-34432
CVE: CVE-2023-3606
Published: 2023-07-10
Description: A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation of the argument host leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233475. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/d4n-sec/cve/blob/main/TamronOS%20IPTV.md; https://vuldb.com/?ctiid.233475; https://vuldb.com/?id.233475
CVE: CVE-2023-3607
Published: 2023-07-10
Description: A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/mohdkey/cve/blob/main/kodbox.md; https://vuldb.com/?ctiid.233476; https://vuldb.com/?id.233476
CVE: CVE-2023-24489
Published: 2023-07-10
Description: A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489; https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24489
CVE: CVE-2023-24490
Published: 2023-07-10
Description: Users with only access to launch VDA applications can launch an unauthorized desktop

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://support.citrix.com/article/CTX559370/windows-and-linux-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve202324490; https://support.citrix.com/article/CTX559370/windows-and-linux-virtual-delivery-agent-for-cvad-and-citrix-daas-security-bulletin-cve202324490
CVE: CVE-2023-30956
Published: 2023-07-10
Description: A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submitted to another comment if they knew the internal UUID of the target attachment. This defect was resolved with the release of Foundry Comments 2.267.0.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a; https://palantir.safebase.us/?tcuUid=40367943-738c-4e69-b852-4a503c77478a
CVE: CVE-2023-30960
Published: 2023-07-10
Description: A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.




CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639, CWE-668
References: https://palantir.safebase.us/?tcuUid=115d9bf4-201f-4cfe-b2fc-219e3a2d945b; https://palantir.safebase.us/?tcuUid=115d9bf4-201f-4cfe-b2fc-219e3a2d945b
CVE: CVE-2023-30963
Published: 2023-07-10
Description: A security defect was discovered in Foundry Frontend which enabled users to perform Stored XSS attacks in Slate if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.229.0. The service was rolled out to all affected Foundry instances. No further intervention is required.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-82, CWE-79
References: https://palantir.safebase.us/?tcuUid=3c6b63b7-fb67-4202-a94a-9c83515efb8a; https://palantir.safebase.us/?tcuUid=3c6b63b7-fb67-4202-a94a-9c83515efb8a
CVE: CVE-2023-3608
Published: 2023-07-10
Description: A vulnerability was found in Ruijie BCR810W 2.5.10. It has been rated as critical. This issue affects some unknown processing of the component Tracert Page. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-233477 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/cq535454518/cve/blob/main/RG-BCR810W.md; https://vuldb.com/?ctiid.233477; https://vuldb.com/?id.233477
CVE: CVE-2023-37191
Published: 2023-07-11
Description: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-37191/blob/main/README.md; https://reference3.example.com/index.php?menu=faxnew; https://github.com/sahiloj/CVE-2023-37191/blob/main/README.md
CVE: CVE-2023-37189
Published: 2023-07-11
Description: A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-37189/blob/main/README.md; https://reference1.example.com/index.php?menu=billing_rates; https://github.com/sahiloj/CVE-2023-37189/blob/main/README.md
CVE: CVE-2023-37190
Published: 2023-07-11
Description: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name parameters under the New Virtual Fax feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-37190/blob/main/README.md; https://reference2.example.com/index.php?menu=grouplist; https://github.com/sahiloj/CVE-2023-37190/blob/main/README.md
CVE: CVE-2023-2078
Published: 2023-07-11
Description: The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to update the plugins settings. CVE-2023-25030 may be a duplicate of this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/admin/class-buy-me-a-coffee-admin.php?rev=2816542; https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/includes/class-buy-me-a-coffee.php?rev=2319979#L162; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2935565%40buymeacoffee&new=2935565%40buymeacoffee&sfp_email=&sfph_mail=
CVE: CVE-2023-2079
Published: 2023-07-11
Description: The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to update the plugins settings, via a forged request granted the attacker can trick a site's administrator into performing an action such as clicking on a link.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/admin/class-buy-me-a-coffee-admin.php?rev=2816542; https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/includes/class-buy-me-a-coffee.php?rev=2319979#L162; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2935565%40buymeacoffee&new=2935565%40buymeacoffee&sfp_email=&sfph_mail=
CVE: CVE-2023-31405
Published: 2023-07-11
Description: SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117
References: https://me.sap.com/notes/3324732; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3324732
CVE: CVE-2023-33987
Published: 2023-07-11
Description: An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.


CVSS Score: 8.6 (HIGH)
CWE: CWE-444
References: https://me.sap.com/notes/3233899; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3233899
CVE: CVE-2023-33988
Published: 2023-07-11
Description: In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in disclosure or modification of information.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3326769; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3326769
CVE: CVE-2023-33989
Published: 2023-07-11
Description: An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system compromise.


CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://me.sap.com/notes/3331376; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3331376
CVE: CVE-2023-33990
Published: 2023-07-11
Description: SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-277, CWE-732
References: https://me.sap.com/notes/3331029; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3331029
CVE: CVE-2023-33992
Published: 2023-07-11
Description: The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.


CVSS Score: 4.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3088078; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3088078
CVE: CVE-2023-35870
Published: 2023-07-11
Description: When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-732
References: https://me.sap.com/notes/3341211; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3341211
CVE: CVE-2023-35871
Published: 2023-07-11
Description: The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.


CVSS Score: 7.7 (HIGH)
CWE: CWE-787, CWE-787
References: https://me.sap.com/notes/3340735; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3340735
CVE: CVE-2023-35872
Published: 2023-07-11
Description: The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://me.sap.com/notes/3343564; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3343564
CVE: CVE-2023-35873
Published: 2023-07-11
Description: The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://me.sap.com/notes/3343547; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3343547
CVE: CVE-2023-35874
Published: 2023-07-11
Description: SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-306
References: https://me.sap.com/notes/3318850; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3318850
CVE: CVE-2023-36917
Published: 2023-07-11
Description: SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functionality. Although the attack has no impact on integrity loss or system availability, this could lead to an attacker to completely takeover a victim’s account.


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-307
References: https://me.sap.com/notes/3320702; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3320702
CVE: CVE-2023-36918
Published: 2023-07-11
Description: In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads to Cross-Site Scripting, which could result in disclosure or modification of information.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3326769; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3326769
CVE: CVE-2023-36919
Published: 2023-07-11
Description: In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-213, CWE-116
References: https://launchpad.support.sap.com/#/notes/3326769; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3326769