deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-20319
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `list_inputs` capability , could perform a remote command execution due to improper user input sanitization on the scripted input files.<br><br>See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Setting up a scripted input ](https://docs.splunk.com/Documentation/Splunk/9.4.2/AdvancedDev/ScriptSetup)for more information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://advisory.splunk.com/advisories/SVD-2025-0702
CVE: CVE-2025-20320
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-35
References: https://advisory.splunk.com/advisories/SVD-2025-0703
CVE: CVE-2025-20321
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or a member of the SHC.<br><br>The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://advisory.splunk.com/advisories/SVD-2025-0704
CVE: CVE-2025-20322
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster through a Cross-Site Request Forgery (CSRF), potentially leading to a denial of service (DoS).<br><br>The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.<br><br>See [How rolling restart works](https://docs.splunk.com/Documentation/Splunk/9.4.2/DistSearch/RestartSHC) for more information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://advisory.splunk.com/advisories/SVD-2025-0705
CVE: CVE-2025-20323
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2025-0706
CVE: CVE-2025-20324
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2025-0707
CVE: CVE-2025-20325
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster [splunk.secret](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/install-splunk-enterprise-securely/deploy-secure-passwords-across-multiple-servers) key. This exposure could happen if you have a Search Head cluster and you configure the Splunk Enterprise `SHCConfig` log channel at the DEBUG logging level in the clustered deployment. <br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. <br><br>See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities), [Deploy a search head cluster](https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/deploy-search-head-clustering/deploy-a-search-head-cluster), [Deploy secure passwords across multiple servers](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/install-splunk-enterprise-securely/deploy-secure-passwords-across-multiple-servers) and [Set a security key for the search head cluster](https://help.splunk.com/splunk-enterprise/administer/distributed-search/9.4/configure-search-head-clustering/set-a-security-key-for-the-search-head-cluster#id_2c54937a_736c_47b5_9485_67e9e390acfa__Set_a_security_key_for_the_search_head_cluster)  for more information.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2025-0709
CVE: CVE-2025-53535
Published: 2025-07-07
Description: Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
CWE: CWE-601
References: https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56
CVE: CVE-2025-53536
Published: 2025-07-07
Description: Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with the php.validate.executablePath setting which lets you set the path for the php executable for syntax validation. The attacker could have written the path to an arbitrary command there and then created a php file to trigger it. This vulnerability is fixed in 3.22.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-552
References: https://github.com/RooCodeInc/Roo-Code/commit/1be6fce1a6864ae63e8160b0666db2c647f2dbba; https://github.com/RooCodeInc/Roo-Code/commit/3993406ebdc0553a32ef391a799a4fb124930a1c; https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-3765-5vjr-qjgm
CVE: CVE-2025-7138
Published: 2025-07-07
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /panel/admin-profile.php. The manipulation of the argument adminname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-23.md; https://vuldb.com/?ctiid.315052; https://vuldb.com/?id.315052
CVE: CVE-2025-7139
Published: 2025-07-07
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /panel/edit-customer-detailed.php of the component Update Customer Details Page. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-1.md; https://vuldb.com/?ctiid.315053; https://vuldb.com/?id.315053
CVE: CVE-2025-53478
Published: 2025-07-07
Description: The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs and User agents” tab.




This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I3a1e21b6800ff4d813a33ee9fe9b7ccf070b6b2e; https://phabricator.wikimedia.org/T394692
CVE: CVE-2025-53488
Published: 2025-07-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension allows Stored XSS.This issue affects Mediawiki - WikiHiero Extension: from 1.43.X before 1.43.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/wikihiero/+/1166018; https://phabricator.wikimedia.org/T396524; https://phabricator.wikimedia.org/T396524
CVE: CVE-2025-53495
Published: 2025-07-07
Description: Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166040; https://phabricator.wikimedia.org/T396750
CVE: CVE-2025-53498
Published: 2025-07-07
Description: Insufficient Logging vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Data Leakage Attacks.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-778
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166844; https://phabricator.wikimedia.org/T397221; https://phabricator.wikimedia.org/T397221
CVE: CVE-2025-53499
Published: 2025-07-07
Description: Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166045; https://phabricator.wikimedia.org/T397196
CVE: CVE-2025-6044
Published: 2025-07-07
Description: An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus while the device is closed and using the screen capture feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-287
References: https://issues.chromium.org/issues/b/421184743; https://issuetracker.google.com/issues/421184743
CVE: CVE-2025-7140
Published: 2025-07-07
Description: A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-staff.php of the component Update Staff Page. The manipulation of the argument Staff Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-2.md; https://vuldb.com/?ctiid.315054; https://vuldb.com/?id.315054
CVE: CVE-2025-7141
Published: 2025-07-07
Description: A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-3.md; https://vuldb.com/?ctiid.315055; https://vuldb.com/?id.315055
CVE: CVE-2025-53496
Published: 2025-07-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Extension allows Stored XSS.This issue affects Mediawiki - MediaSearch Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MediaSearch/+/1166030; https://phabricator.wikimedia.org/T396946
CVE: CVE-2025-53539
Published: 2025-07-07
Description: FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. fastapi-guard's penetration attempts detection uses regex to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. This vulnerability is fixed in 3.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f; https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-j47q-rc62-w448
CVE: CVE-2025-53540
Published: 2025-07-07
Description: arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints accept POST requests for firmware uploads without CSRF protection. This allows an attacker to upload and execute arbitrary firmware, resulting in remote code execution (RCE). This vulnerability is fixed in 3.2.1.
CWE: CWE-352
References: https://github.com/espressif/arduino-esp32/commit/f4fdecc60c465384e465a4b1d2bd1eac8f67912e; https://github.com/espressif/arduino-esp32/security/advisories/GHSA-9vfw-wx65-c872
CVE: CVE-2025-53543
Published: 2025-07-07
Description: Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/kestra-io/kestra/security/advisories/GHSA-qpj4-4r6r-wvf4
CVE: CVE-2025-7142
Published: 2025-07-07
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/search-appointment.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-4.md; https://vuldb.com/?ctiid.315056; https://vuldb.com/?id.315056
CVE: CVE-2025-7143
Published: 2025-07-07
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/edit-tax.php of the component Update Tax Page. The manipulation of the argument Tax Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-5.md; https://vuldb.com/?ctiid.315057; https://vuldb.com/?id.315057
CVE: CVE-2025-7144
Published: 2025-07-07
Description: A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /panel/admin-profile.php of the component Admin Profile Page. The manipulation of the argument Admin Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-6.md; https://vuldb.com/?ctiid.315058; https://vuldb.com/?id.315058
CVE: CVE-2025-7147
Published: 2025-07-07
Description: A vulnerability has been found in CodeAstro Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/Vanshdhawan188/Patient-Record-Management-System-SQL/blob/main/Patient%20Record%20Management%20System.md; https://vuldb.com/?ctiid.315085
CVE: CVE-2025-7148
Published: 2025-07-07
Description: A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /patient.html of the component POST Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://codeastro.com/; https://github.com/Vanshdhawan188/Simple-Hospital-Management-System-in-Python-CodeAstro-Patients-Stored-XSS/blob/main/Simple%20Hospital%20Management%20System%20in%20Python%20CodeAstro%20Patients%20Stored%20XSS.md; https://vuldb.com/?ctiid.315086
CVE: CVE-2025-7149
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/candidates_delete.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/y2xsec324/cve/issues/4; https://vuldb.com/?ctiid.315087; https://vuldb.com/?id.315087
CVE: CVE-2025-7150
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/voters_delete.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/y2xsec324/cve/issues/5; https://vuldb.com/?ctiid.315088; https://vuldb.com/?id.315088
CVE: CVE-2025-7151
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/voters_add.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/y2xsec324/cve/issues/7; https://vuldb.com/?ctiid.315089; https://vuldb.com/?id.315089
CVE: CVE-2025-7152
Published: 2025-07-08
Description: A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candidates_add.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/y2xsec324/cve/issues/8; https://vuldb.com/?ctiid.315090; https://vuldb.com/?id.315090
CVE: CVE-2025-7153
Published: 2025-07-08
Description: A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor.html of the component POST Parameter Handler. The manipulation of the argument First Name/Last name/Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://codeastro.com/; https://github.com/Vanshdhawan188/Simple-Hospital-Management-System-in-Python-CodeAstro-Patients-Stored-XSS-Doctors-Page/blob/main/Simple-Hospital-Management-System-in-Python-CodeAstro-Patients-Stored-XSS-Doctors%20Page.md; https://vuldb.com/?ctiid.315091
CVE: CVE-2025-31326
Published: 2025-07-08
Description: SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended redirects or manipulation of application behavior, such as redirecting users to attacker-controlled domains. This issue primarily affects the integrity of the system. However, the confidentiality and availability of the system remain unaffected.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-80
References: https://me.sap.com/notes/3573199; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42952
Published: 2025-07-08
Description: SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by triggering short dumps on login. This could cause a high impact on availability. Data confidentiality and integrity are not affected. No data can be read, changed or deleted.
CVSS Score: 7.7 (HIGH)
CWE: CWE-862
References: https://me.sap.com/notes/3623255; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42953
Published: 2025-07-08
Description: SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://me.sap.com/notes/3623440; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42954
Published: 2025-07-08
Description: SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on availability of the application, there is no impact on confidentiality and integrity.
CVSS Score: 2.7 (LOW)
CWE: CWE-835
References: https://me.sap.com/notes/3608156; https://url.sap/sapsecuritypatchday