deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0772
Published: 2023-03-13
Description: The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c; https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c
CVE: CVE-2023-0844
Published: 2023-03-13
Description: The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8d8e5852-3787-47f9-9931-8308bb81beb1; https://wpscan.com/vulnerability/8d8e5852-3787-47f9-9931-8308bb81beb1
CVE: CVE-2023-25170
Published: 2023-03-13
Description: PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). When authenticating users, PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. The problem is fixed in version 8.0.1.

CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3g43-x7qr-96ph; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3g43-x7qr-96ph
CVE: CVE-2021-45423
Published: 2023-03-13
Description: A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically allocated on the stack using exp->NumberOfFunctions as its size. However, the loop uses exp->NumberOfNames to iterate over it and set its components value. Therefore, the loop code assumes that exp->NumberOfFunctions is greater than ordinal at each iteration. This can lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/merces/libpe/issues/35; https://github.com/merces/libpe/issues/35
CVE: CVE-2023-0973
Published: 2023-03-13
Description: 
STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.


CVSS Score: 2.2 (LOW)
CWE: CWE-476
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-04
CVE: CVE-2023-1378
Published: 2023-03-13
Description: A vulnerability classified as critical was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. This vulnerability affects unknown code of the file paypalsuccess.php of the component POST Parameter Handler. The manipulation of the argument cusid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222904.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ATW-BlockN/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/SQLi-1.md; https://vuldb.com/?ctiid.222904; https://vuldb.com/?id.222904
CVE: CVE-2023-27580
Published: 2023-03-13
Description: CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password. Upgrade to Shield v1.0.0-beta.4 or later to fix this issue. After upgrading, all users’ hashed passwords should be updated (saved to the database). There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html; https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords; https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md
CVE: CVE-2023-25279
Published: 2023-03-13
Description: OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20In%20tools_AccountName; https://www.dlink.com/en/security-bulletin/; https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20Inject%20In%20tools_AccountName
CVE: CVE-2023-27010
Published: 2023-03-13
Description: Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges via modifying or overwriting the executable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://cwe.mitre.org/data/definitions/250.html; https://packetstormsecurity.com/files/171301/Wondershare-Dr-Fone-12.9.6-Weak-Permissions-Privilege-Escalation.html; https://cwe.mitre.org/data/definitions/250.html
CVE: CVE-2022-37941
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37942
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37943
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37944
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37945
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37946
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37947
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37948
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37949
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37950
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2022-37951
Published: 2023-03-13
Description: Rejected reason: Not used in 2022
CVE: CVE-2023-0355
Published: 2023-03-13
Description: Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information.
CVSS Score: 6.5 (MEDIUM)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-25207
Published: 2023-03-13
Description: PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://addons.prestashop.com/fr/transporteurs/19414-dpd-france.html; https://friends-of-presta.github.io/security-advisories/modules/2023/03/09/dpdfrance.html; https://addons.prestashop.com/fr/transporteurs/19414-dpd-france.html
CVE: CVE-2023-25802
Published: 2023-03-13
Description: Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-26, CWE-668
References: https://github.com/hap-wi/roxy-wi/commit/0054f25da7cf8c7480452f48e39308b5e392dc67; https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-qcmp-q5h3-784m; https://github.com/hap-wi/roxy-wi/commit/0054f25da7cf8c7480452f48e39308b5e392dc67
CVE: CVE-2023-25803
Published: 2023-03-13
Description: Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that allows the inclusion of server-side files. This issue is fixed in version 6.3.5.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-cv9w-j9gh-5j3w; https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-cv9w-j9gh-5j3w
CVE: CVE-2023-0345
Published: 2023-03-13
Description: The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the user.
CVSS Score: 9.8 (CRITICAL)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0346
Published: 2023-03-13
Description: Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of a device if known.
CVSS Score: 7.5 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0347
Published: 2023-03-13
Description: The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to identify the device on the Akuvox cloud.
CVSS Score: 7.5 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0348
Published: 2023-03-13
Description: Akuvox E11 allows direct SIP calls. No access control is enforced by the SIP servers, which could allow an attacker to contact any device within Akuvox to call any other device.
CVSS Score: 7.5 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0349
Published: 2023-03-13
Description: The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record image and video from the camera.
CVSS Score: 7.5 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0350
Published: 2023-03-13
Description: Akuvox E11 does not ensure that a file extension is associated with the file provided. This could allow an attacker to upload a file to the device by changing the extension of a malicious file to an accepted file type.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0351
Published: 2023-03-13
Description: The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0352
Published: 2023-03-13
Description: The Akuvox E11 password recovery webpage can be accessed without authentication, and an attacker could download the device key file. An attacker could then use this page to reset the password back to the default.
CVSS Score: 9.1 (CRITICAL)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0353
Published: 2023-03-13
Description: Akuvox E11 uses a weak encryption algorithm for stored passwords and uses a hard-coded password for decryption which could allow the encrypted passwords to be decrypted from the configuration file.
CVSS Score: 7.2 (HIGH)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-0354
Published: 2023-03-13
Description: The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs.
CVSS Score: 9.1 (CRITICAL)
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
CVE: CVE-2023-24368
Published: 2023-03-13
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-27581
Published: 2023-03-13
Description: github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. This can be used to execute code on the GitHub runners and to exfiltrate any secrets one uses in the CI pipeline. A patched action is available in version 4.4.1. No workaround is available.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/rlespinasse/github-slug-action/commit/102b1a064a9b145e56556e22b18b19c624538d94; https://github.com/rlespinasse/github-slug-action/releases/tag/v4.4.1; https://github.com/rlespinasse/github-slug-action/security/advisories/GHSA-6q4m-7476-932w
CVE: CVE-2023-27583
Published: 2023-03-13
Description: PanIndex is a network disk directory index. In Panindex prior to version 3.1.3,  a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, one may change the JWT key in the source code before compiling the project.
  

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://github.com/px-org/PanIndex/commit/f7ec0c5739af055ad3a825a20294a5c01ada3302; https://github.com/px-org/PanIndex/releases/tag/v3.1.3; https://github.com/px-org/PanIndex/security/advisories/GHSA-82wq-gmw8-g87v
CVE: CVE-2023-27052
Published: 2023-03-13
Description: E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_user.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/lcg-22266/bug_report/blob/main/vendors/razormist/Moosikay%20-%20E-Commerce%20System/SQLi-1.md; https://github.com/lcg-22266/bug_report/blob/main/vendors/razormist/Moosikay%20-%20E-Commerce%20System/SQLi-1.md
CVE: CVE-2023-27582
Published: 2023-03-13
Description: maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username. maddy 0.6.3 includes the fix for the bug. There are no known workarounds.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-305, CWE-287
References: https://github.com/foxcpp/maddy/commit/55a91a37b71210f34f98f4d327c30308fe24399a; https://github.com/foxcpp/maddy/commit/9f58cb64b39cdc01928ec463bdb198c4c2313a9c; https://github.com/foxcpp/maddy/releases/tag/v0.6.3
CVE: CVE-2023-27587
Published: 2023-03-13
Description: ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, then it will include the full URL of the request. The request URL contains the Google Cloud API key. This has been patched in commit 8533b01. Upgrading should be accompanied by deleting the current GCP API key and issuing a new one. There are no known workarounds.
CVSS Score: 7.4 (HIGH)
CWE: CWE-209
References: https://github.com/rozbb/readtomyshoe/commit/8533b01c818939a0fa919c7244d8dbf5daf032af; https://github.com/rozbb/readtomyshoe/security/advisories/GHSA-23g5-r34j-mr8g; https://github.com/rozbb/readtomyshoe/commit/8533b01c818939a0fa919c7244d8dbf5daf032af
CVE: CVE-2023-24279
Published: 2023-03-14
Description: A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.edoardoottavianelli.it/; https://www.edoardoottavianelli.it/CVE-2023-24279; https://www.youtube.com/watch?v=1mSXzzwcGMM
CVE: CVE-2023-0021
Published: 2023-03-14
Description: Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3274920; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3274920
CVE: CVE-2023-23857
Published: 2023-03-14
Description: Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.


CVSS Score: 9.9 (CRITICAL)
CWE: CWE-287
References: https://launchpad.support.sap.com/#/notes/3252433; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3252433
CVE: CVE-2023-24526
Published: 2023-03-14
Description: SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/3288394; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3288394
CVE: CVE-2023-25615
Published: 2023-03-14
Description: Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the current session of the user by injecting the malicious database queries over the network and gain access to the unintended data. This may lead to a high impact on the confidentiality and no impact on the availability and integrity of the application.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://launchpad.support.sap.com/#/notes/3289844; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3289844
CVE: CVE-2023-25616
Published: 2023-03-14
Description: In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.


CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://launchpad.support.sap.com/#/notes/3245526; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3245526
CVE: CVE-2023-25617
Published: 2023-03-14
Description: SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://launchpad.support.sap.com/#/notes/3283438; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3283438
CVE: CVE-2023-25618
Published: 2023-03-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://launchpad.support.sap.com/#/notes/3296346; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3296346
CVE: CVE-2023-26457
Published: 2023-03-14
Description: SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3281484; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3281484
CVE: CVE-2023-26459
Published: 2023-03-14
Description: Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to an arbitrary URL which can reveal, modify or make unavailable non-sensitive information, leading to low impact on Confidentiality, Integrity and Availability.


CVSS Score: 7.4 (HIGH)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/3296346; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3296346
CVE: CVE-2023-26460
Published: 2023-03-14
Description: Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://launchpad.support.sap.com/#/notes/3288096; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3288096