deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10028
Published: 2020-05-11
Description: Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10028; https://github.com/zephyrproject-rtos/zephyr/pull/23308; https://github.com/zephyrproject-rtos/zephyr/pull/23733
CVE: CVE-2020-10058
Published: 2020-05-11
Description: Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges. See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10058; https://github.com/zephyrproject-rtos/zephyr/pull/23308; https://github.com/zephyrproject-rtos/zephyr/pull/23748
CVE: CVE-2020-10059
Published: 2020-05-11
Description: The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10059; https://github.com/zephyrproject-rtos/zephyr/pull/24954; https://github.com/zephyrproject-rtos/zephyr/pull/24997
CVE: CVE-2020-10060
Published: 2020-05-11
Description: In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-824
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10060; https://github.com/zephyrproject-rtos/zephyr/pull/27865; https://github.com/zephyrproject-rtos/zephyr/pull/27889
CVE: CVE-2020-10067
Published: 2020-05-11
Description: A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel. See NCC-ZEP-005 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10067; https://github.com/zephyrproject-rtos/zephyr/pull/23239; https://github.com/zephyrproject-rtos/zephyr/pull/23653
CVE: CVE-2020-11071
Published: 2020-05-12
Description: SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This is fixed in version 0.27.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-697, CWE-697
References: https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754; https://github.com/simpleledger/slpjs/security/advisories/GHSA-jc83-cpf9-q7c6; https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754
CVE: CVE-2020-11072
Published: 2020-05-12
Description: In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.
CVSS Score: 8.6 (HIGH)
CWE: CWE-697, CWE-697
References: https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7; https://github.com/simpleledger/slp-validate/security/advisories/GHSA-4w97-57v2-3w44; https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7
CVE: CVE-2020-8151
Published: 2020-05-12
Description: There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-863
References: https://groups.google.com/forum/#%21topic/rubyonrails-security/pktoF4VmiM8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P7B7A4H22DZ522HLDS3JX3NX2CXIOZSR/; https://groups.google.com/forum/#%21topic/rubyonrails-security/pktoF4VmiM8
CVE: CVE-2020-8153
Published: 2020-05-12
Description: Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-732
References: https://hackerone.com/reports/642515; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/; https://nextcloud.com/security/advisory/?id=NC-SA-2020-017
CVE: CVE-2020-8154
Published: 2020-05-12
Description: An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
CVSS Score: 7.7 (HIGH)
CWE: CWE-639, CWE-639
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html
CVE: CVE-2020-8155
Published: 2020-05-12
Description: An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html
CVE: CVE-2020-8156
Published: 2020-05-12
Description: A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.
CVSS Score: 7.0 (HIGH)
CWE: CWE-295, CWE-295
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/; https://nextcloud.com/security/advisory/?id=NC-SA-2020-020; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE: CVE-2020-8159
Published: 2020-05-12
Description: There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://groups.google.com/forum/#%21topic/rubyonrails-security/CFRVkEytdP8; https://lists.debian.org/debian-lts-announce/2021/07/msg00019.html; https://groups.google.com/forum/#%21topic/rubyonrails-security/CFRVkEytdP8
CVE: CVE-2019-4478
Published: 2020-05-12
Description: IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not normally have access to. IBM X-Force ID: 163998.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163998; https://www.ibm.com/support/pages/node/6208436; https://exchange.xforce.ibmcloud.com/vulnerabilities/163998
CVE: CVE-2020-10706
Published: 2020-05-12
Description: A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via the WebUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer valid.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10706; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10706
CVE: CVE-2020-10741
Published: 2020-05-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-12826. Reason: This candidate is a duplicate of CVE-2020-12826. Notes: All CVE users should reference CVE-2020-12826 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-1763
Published: 2020-05-12
Description: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1813329; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763; https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
CVE: CVE-2020-4195
Published: 2020-05-12
Description: IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 174859.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174859; https://www.ibm.com/support/pages/node/6208048; https://exchange.xforce.ibmcloud.com/vulnerabilities/174859
CVE: CVE-2020-4346
Published: 2020-05-12
Description: IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178322; https://www.ibm.com/support/pages/node/6208328; https://exchange.xforce.ibmcloud.com/vulnerabilities/178322
CVE: CVE-2020-9310
Published: 2020-05-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-1939
Published: 2020-05-12
Description: The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://lists.apache.org/thread.html/re3adc65ff4d8d9c34e5bccba3941a28cbb0a47191c150df2727e101d%40%3Cdev.nuttx.apache.org%3E; https://lists.apache.org/thread.html/re3adc65ff4d8d9c34e5bccba3941a28cbb0a47191c150df2727e101d%40%3Cdev.nuttx.apache.org%3E
CVE: CVE-2020-5248
Published: 2020-05-12
Description: GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798, CWE-798
References: https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c; https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9; https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c
CVE: CVE-2020-5896
Published: 2020-05-12
Description: On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.f5.com/csp/article/K15478554; https://support.f5.com/csp/article/K15478554
CVE: CVE-2020-5897
Published: 2020-05-12
Description: In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://support.f5.com/csp/article/K20346072; https://support.f5.com/csp/article/K20346072
CVE: CVE-2020-5898
Published: 2020-05-12
Description: In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. A local user on the Windows client system can send crafted DeviceIoControl requests to \\.\urvpndrv device causing the Windows kernel to crash.
CVSS Score: 5.5 (MEDIUM)
References: https://support.f5.com/csp/article/K69154630; https://support.f5.com/csp/article/K69154630
CVE: CVE-2020-12823
Published: 2020-05-12
Description: OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00056.html; https://bugs.gentoo.org/721570
CVE: CVE-2020-12825
Published: 2020-05-12
Description: libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.
CVSS Score: 7.1 (HIGH)
CWE: CWE-674
References: http://www.openwall.com/lists/oss-security/2020/08/13/3; http://www.openwall.com/lists/oss-security/2020/09/08/3; https://gitlab.gnome.org/GNOME/libcroco/-/issues/8
CVE: CVE-2020-1746
Published: 2020-05-12
Description: A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746; https://github.com/ansible/ansible/pull/67866; https://www.debian.org/security/2021/dsa-4950
CVE: CVE-2020-6240
Published: 2020-05-12
Description: SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2856923; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2856923
CVE: CVE-2020-6241
Published: 2020-05-12
Description: SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://launchpad.support.sap.com/#/notes/2916927; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2916927
CVE: CVE-2020-6242
Published: 2020-05-12
Description: SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/2885244; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
CVE: CVE-2020-6243
Published: 2020-05-12
Description: Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/2915585; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2915585
CVE: CVE-2020-6244
Published: 2020-05-12
Description: SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://launchpad.support.sap.com/#/notes/2911801; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2911801
CVE: CVE-2020-6245
Published: 2020-05-12
Description: SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-99, CWE-74
References: https://launchpad.support.sap.com/#/notes/2828558; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2828558
CVE: CVE-2020-6247
Published: 2020-05-12
Description: SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2828558; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2828558
CVE: CVE-2020-6248
Published: 2020-05-12
Description: SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-94
References: https://launchpad.support.sap.com/#/notes/2917275; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2917275
CVE: CVE-2020-6249
Published: 2020-05-12
Description: The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://launchpad.support.sap.com/#/notes/2908560; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2908560
CVE: CVE-2020-6250
Published: 2020-05-12
Description: SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop the server like an administrator.
CVSS Score: 6.8 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2917022; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2917022
CVE: CVE-2020-6251
Published: 2020-05-12
Description: Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2828558; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2828558
CVE: CVE-2020-6252
Published: 2020-05-12
Description: Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact system availability.
CVSS Score: 8.0 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2917090; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2917090
CVE: CVE-2020-6253
Published: 2020-05-12
Description: Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries to elevate their privileges, modify database objects, or execute commands they are not otherwise authorized to execute, leading to SQL Injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://launchpad.support.sap.com/#/notes/2917273; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2917273
CVE: CVE-2020-6254
Published: 2020-05-12
Description: SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2913293; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2913293
CVE: CVE-2020-6256
Published: 2020-05-12
Description: SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required authorizations, due to Missing Authorization Check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2912747; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2912747
CVE: CVE-2020-6257
Published: 2020-05-12
Description: SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2907781; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222; https://launchpad.support.sap.com/#/notes/2907781