deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33002
Published: 2024-05-14
Description: Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3460772; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3460772
CVE: CVE-2024-33004
Published: 2024-05-14
Description: SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-524, CWE-922
References: https://me.sap.com/notes/3449093; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3449093
CVE: CVE-2024-33006
Published: 2024-05-14
Description: 
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system. 


CVSS Score: 9.6 (CRITICAL)
CWE: CWE-434
References: https://me.sap.com/notes/3448171; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3448171
CVE: CVE-2024-33007
Published: 2024-05-14
Description: PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://me.sap.com/notes/3446076; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3446076
CVE: CVE-2024-33008
Published: 2024-05-14
Description: SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with high impact on Availability of the system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787
References: https://me.sap.com/notes/3349468; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3349468
CVE: CVE-2024-33009
Published: 2024-05-14
Description: SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could lead to low impact on Confidentiality and Integrity of the application.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-89
References: https://me.sap.com/notes/1938764; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/1938764
CVE: CVE-2024-33489
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-33490
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-33491
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-33492
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-33493
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-33494
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected components do not properly authenticate heartbeat messages. This could allow an unauthenticated remote attacker to affected the availability of secondary RTLS systems configured using a TeeRevProxy service and potentially cause loss of data generated during the time the attack is ongoing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33495
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected application does not properly limit the size of specific logs. This could allow an unauthenticated remote attacker to exhaust system resources by creating a great number of log entries which could potentially lead to a denial of service condition. A successful exploitation requires the attacker to have access to specific SIMATIC RTLS Locating Manager Clients in the deployment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33496
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33497
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected SIMATIC RTLS Locating Manager Track Viewer Client do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33498
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected applications do not properly release memory that is allocated when handling specifically crafted incoming packets. This could allow an unauthenticated remote attacker to cause a denial of service condition by crashing the service when it runs out of memory. The service is restarted automatically after a short time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33499
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected application assigns incorrect permissions to a user management component. This could allow a privileged attacker to escalate their privileges from the Administrators group to the Systemadministrator group.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33577
Published: 2024-05-14
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one of the application binaries. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/html/ssa-064222.html; https://cert-portal.siemens.com/productcert/html/ssa-258494.html; https://cert-portal.siemens.com/productcert/html/ssa-064222.html
CVE: CVE-2024-33583
Published: 2024-05-14
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected application contains a hidden configuration item to enable debug functionality. This could allow an authenticated local attacker to gain insight into the internal configuration of the deployment.
CVSS Score: 3.3 (LOW)
CWE: CWE-912
References: https://cert-portal.siemens.com/productcert/html/ssa-093430.html; https://cert-portal.siemens.com/productcert/html/ssa-093430.html
CVE: CVE-2024-33647
Published: 2024-05-14
Description: A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/html/ssa-925850.html; https://cert-portal.siemens.com/productcert/html/ssa-925850.html
CVE: CVE-2024-33863
Published: 2024-05-14
Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://linqi.help/Updates/en#/SecurityUpdates; https://www.linqi.de/de-DE/blog.html; https://linqi.help/Updates/en#/SecurityUpdates
CVE: CVE-2024-33864
Published: 2024-05-14
Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-918
References: https://linqi.help/Updates/en#/SecurityUpdates; https://www.linqi.de/de-DE/blog.html; https://linqi.help/Updates/en#/SecurityUpdates
CVE: CVE-2024-33865
Published: 2024-05-14
Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is an NTLM hash leak via the /api/Cdn/GetFile and /api/DocumentTemplate/{GUID] endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://linqi.help/Updates/en#/SecurityUpdates; https://www.linqi.de/de-DE/blog.html; https://linqi.help/Updates/en#/SecurityUpdates
CVE: CVE-2024-33866
Published: 2024-05-14
Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/DocumentTemplate/{GUID] XSS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://linqi.help/Updates/en#/SecurityUpdates; https://www.linqi.de/de-DE/blog.html; https://linqi.help/Updates/en#/SecurityUpdates
CVE: CVE-2024-33867
Published: 2024-05-14
Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-259
References: https://linqi.help/Updates/en#/SecurityUpdates; https://www.linqi.de/de-DE/blog.html; https://linqi.help/Updates/en#/SecurityUpdates
CVE: CVE-2024-33868
Published: 2024-05-14
Description: An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-90
References: https://linqi.help/Updates/en#/SecurityUpdates; https://www.linqi.de/de-DE/blog.html; https://linqi.help/Updates/en#/SecurityUpdates
CVE: CVE-2024-34085
Published: 2024-05-14
Description: A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamcenter Visualization V14.2 (All versions < V14.2.0.10), Teamcenter Visualization V14.3 (All versions < V14.3.0.7), Teamcenter Visualization V2312 (All versions < V2312.0001). The affected applications contain a stack overflow vulnerability while parsing specially crafted XML files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/html/ssa-661579.html; https://cert-portal.siemens.com/productcert/html/ssa-661579.html
CVE: CVE-2024-34086
Published: 2024-05-14
Description: A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), Teamcenter Visualization V14.2 (All versions < V14.2.0.10), Teamcenter Visualization V14.3 (All versions < V14.3.0.7), Teamcenter Visualization V2312 (All versions < V2312.0001). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted CGM file.
This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-661579.html; https://cert-portal.siemens.com/productcert/html/ssa-661579.html
CVE: CVE-2024-34191
Published: 2024-05-14
Description: htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35
References: https://chmod744.super.site/htmly-cve; https://chmod744.super.site/htmly-cve
CVE: CVE-2024-34243
Published: 2024-05-14
Description: Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/JByteL/CVE/tree/main/CVE-2024-34243; https://github.com/JByteL/CVE/tree/main/CVE-2024-34243
CVE: CVE-2024-34256
Published: 2024-05-14
Description: OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ZackSecurity/VulnerReport/blob/cve/ofcms/1.md; https://github.com/ZackSecurity/VulnerReport/blob/cve/ofcms/1.md
CVE: CVE-2024-34355
Published: 2024-05-14
Description: TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-116, CWE-79
References: https://github.com/TYPO3/typo3/commit/56afa304ba8b5ad302e15df5def71bcc8d820375; https://github.com/TYPO3/typo3/security/advisories/GHSA-xjwx-78x7-q6jc; https://typo3.org/security/advisory/typo3-core-sa-2024-007
CVE: CVE-2024-34356
Published: 2024-05-14
Description: TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156; https://github.com/TYPO3/typo3/commit/d0393a879a32fb4e3569acad6bdb5cda776be1e5; https://github.com/TYPO3/typo3/commit/e95a1224719efafb9cab2d85964f240fd0356e64
CVE: CVE-2024-34357
Published: 2024-05-14
Description: TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/typo3/commit/376474904f6b9a54dc1b785a2e45277cbd13b0d7; https://github.com/TYPO3/typo3/commit/b31d05d1da3eeaeead2d19eb43b1c3f9c88e15ee; https://github.com/TYPO3/typo3/commit/d[PII_REDACTED]54d3bf5095a5a26e18acd2767f0b1
CVE: CVE-2024-34358
Published: 2024-05-14
Description: TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-347, CWE-770
References: https://github.com/TYPO3/typo3/commit/05c95fed869a1a6dcca06c7077b83b6ea866ff14; https://github.com/TYPO3/typo3/commit/1e70ebf736935413b[PII_REDACTED]362b4fb0755a5; https://github.com/TYPO3/typo3/commit/df7909b6a1cf0f12a42994d0cc3376b607746142
CVE: CVE-2024-34687
Published: 2024-05-14
Description: SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3448445; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3448445
CVE: CVE-2024-34712
Published: 2024-05-14
Description: Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encoded, resulting in specially crafted input such as `../../../channels/{id}` being normalized into the url `/api/v10/channels/{id}`, and deleting a channel rather than removing a ban. Version 1.10.4 fixes this issue. Some workarounds are available. One may sanitize user input, ensuring strings are valid for the purpose they are being used for. One may also encode input with `encodeURIComponent` before providing it to the library.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-23
References: https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe; https://github.com/OceanicJS/Oceanic/security/advisories/GHSA-5h5v-hw44-f6gg; https://github.com/OceanicJS/Oceanic/commit/8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe