rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-0318 
Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver Application Server for Java (Startup Framework)
Published: 2019-07-10T18:48:07.000Z
CVE-2019-0319 
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.
Problem types: description: Content Injection
Affected products: vendor: SAP SE
product: SAP Gateway
Published: 2019-07-10T18:51:55.000Z
CVE-2019-0321 
ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: ABAP Server and ABAP Platform (SAP Basis)
Published: 2019-07-10T18:54:44.000Z
CVE-2019-0322 
SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP Commerce Cloud (ex SAP Hybris Commerce) (HY_COM)
Published: 2019-07-10T19:00:32.000Z
CVE-2019-0325 
SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.
Problem types: description: Missing Authorization
Affected products: vendor: SAP SE
product: SAP ERP HCM (SAP_HRCES)
Published: 2019-07-10T19:04:13.000Z
CVE-2019-0326 
SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform - BI Workspace (Enterprise)
Published: 2019-07-10T19:07:58.000Z
CVE-2019-0327 
SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.
Problem types: description: Unrestricted File Upload
Affected products: vendor: SAP SE
product: SAP NetWeaver for Java Application Server - Web Container (engineapi)
vendor: SAP SE
product: SAP NetWeaver for Java Application Server - Web Container (servercode)
Published: 2019-07-10T19:09:39.000Z
CVE-2019-0328 
ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP NetWeaver Process Integration ABAP tests (SAP Basis)
Published: 2019-07-10T19:10:37.000Z
CVE-2019-0329 
SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Information Steward
Published: 2019-07-10T19:11:25.000Z
CVE-2019-0330 
The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Diagnostic Agent (LM-Service)
Published: 2019-07-10T19:12:16.000Z
CVE-2019-0331 
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (BI Workspace)
Published: 2019-08-14T13:43:15.000Z
CVE-2019-0332 
SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Info View)
Published: 2019-08-14T13:44:00.000Z
CVE-2019-0333 
In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
Published: 2019-08-14T13:47:36.000Z
CVE-2019-0334 
When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (BI Workspace)
Published: 2019-08-14T13:48:51.000Z
CVE-2019-0335 
Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (CMC)
Published: 2019-08-14T13:44:29.000Z
CVE-2019-0337 
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver Process Integration (Java Proxy Runtime)
Published: 2019-08-14T13:47:00.000Z
CVE-2019-0338 
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Gateway
Published: 2019-08-14T13:49:43.000Z
CVE-2019-0340 
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
Problem types: description: Missing XML Validation
Affected products: vendor: SAP SE
product: SAP Enable Now
Published: 2019-08-14T13:51:45.000Z
CVE-2019-0341 
The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Enable Now
Published: 2019-08-14T13:50:44.000Z
CVE-2019-0343 
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Commerce Cloud (Mediaconversion Extension)
Published: 2019-08-14T13:53:05.000Z
CVE-2019-0344 
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Commerce Cloud (virtualjdbc extension)
Published: 2019-08-14T13:53:21.000Z
CVE-2019-0345 
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: SAP SE
product: SAP NetWeaver Application Server for Java (Administrator System Overview)
Published: 2019-08-14T13:54:04.000Z
CVE-2019-0346 
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (CMC)
Published: 2019-08-14T13:54:58.000Z
CVE-2019-0348 
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Web Intelligence)
Published: 2019-08-14T13:55:54.000Z
CVE-2019-0349 
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Kernel (KRNL32NUC)
vendor: SAP SE
product: SAP Kernel (KRNL32UC)
vendor: SAP SE
product: SAP Kernel (KRNL64NUC)
vendor: SAP SE
product: SAP Kernel (KRNL64UC)
vendor: SAP SE
product: SAP Kernel (KERNEL)
Published: 2019-08-14T14:54:52.000Z
CVE-2019-0350 
SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP HANA Database
Published: 2019-11-04T14:33:20.000Z
CVE-2019-0351 
A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this, an attacker can exploit Services Registry potentially enabling them to take complete control of the product, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.
Problem types: description: others
Affected products: vendor: SAP SE
product: SAP NetWeaver UDDI Server (Services Registry)
Published: 2019-08-14T13:57:00.000Z
CVE-2019-0352 
In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.
Problem types: description: Other
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (CMC)
Published: 2019-09-10T16:03:38.000Z
CVE-2019-0353 
Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business One Client
Published: 2019-09-10T16:05:23.000Z
CVE-2019-0355 
SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for Java (Web Container)-ENGINEAPI
vendor: SAP SE
product: SAP NetWeaver AS for Java (Web Container)-SAP-JEECOR
Published: 2019-09-10T16:07:10.000Z
CVE-2019-0356 
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF
Published: 2019-09-10T16:27:52.000Z
CVE-2019-0357 
The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP HANA
Published: 2019-09-10T16:48:14.000Z
CVE-2019-0361 
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Supplier Relationship Management (Master Data Management Catalog) (SRM_MDM_CAT)
Published: 2019-09-10T16:09:25.000Z
CVE-2019-0363 
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrieve information about internal network ports.
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP HANA Extended Application Services
Published: 2019-09-10T16:11:19.000Z
CVE-2019-0364 
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports.
Problem types: description: Other
Affected products: vendor: SAP SE
product: SAP HANA Extended Application Services
Published: 2019-09-10T16:13:22.000Z
CVE-2019-0365 
SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP Kernel (KRNL32NUC)
vendor: SAP SE
product: SAP Kernel (KRNL32UC)
vendor: SAP SE
product: SAP Kernel (KRNL64NUC)
vendor: SAP SE
product: SAP Kernel (KRNL64UC)
vendor: SAP SE
product: SAP Kernel (KERNEL)
vendor: SAP SE
product: SAP GUI for Windows (BC-FES-GUI)
vendor: SAP SE
product: SAP GUI for Java (BC-FES-JAV)
Published: 2019-09-10T16:15:26.000Z
CVE-2019-0367 
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP NetWeaver Process Integration (B2B Toolkit)
Published: 2019-10-08T19:16:25.000Z
CVE-2019-0368 
SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Customer Relationship Management (Email Management - S4CRM)
vendor: SAP SE
product: SAP Customer Relationship Management (Email Management - BBPCRM)
Published: 2019-10-08T19:17:44.000Z
CVE-2019-0369 
SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to reflected cross site scripting vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Financial Consolidation
Published: 2019-10-08T19:19:11.000Z
CVE-2019-0370 
Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.
Problem types: description: Others
Affected products: vendor: SAP SE
product: SAP Financial Consolidation
Published: 2019-10-08T19:20:08.000Z
CVE-2019-0374 
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2019-10-08T19:21:30.000Z
CVE-2019-0375 
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2019-10-08T19:22:26.000Z
CVE-2019-0376 
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2019-10-08T19:23:56.000Z
CVE-2019-0377 
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2019-10-08T19:24:50.000Z
CVE-2019-0378 
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2019-10-08T19:25:44.000Z
CVE-2019-0379 
SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle (BC), leading to Missing Authentication Check
Problem types: description: Missing Authentication Check
Affected products: vendor: SAP SE
product: SAP Process Integration, business-to-business add-on
Published: 2019-10-08T19:27:11.000Z
CVE-2019-0380 
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Landscape Management enterprise edition
Published: 2019-10-08T19:31:03.000Z
CVE-2019-0381 
A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user.
Problem types: description: Other
Affected products: vendor: SAP SE
product: SAP IQ
vendor: SAP SE
product: SAP SQL Anywhere
vendor: SAP SE
product: SAP Dynamic Tiering
Published: 2019-10-08T19:29:26.000Z
CVE-2019-0382 
A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2. Privileges are required in order to exploit this vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
Published: 2019-11-13T21:59:11.000Z
CVE-2019-0383 
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Treasury and Risk Management (S4CORE)
vendor: SAP SE
product: SAP Treasury and Risk Management (EA-FINSERV)
Published: 2019-12-17T19:21:56.000Z
CVE-2019-0384 
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Treasury and Risk Management (S4CORE)
vendor: SAP SE
product: SAP Treasury and Risk Management (EA-FINSERV)
Published: 2019-12-17T19:24:06.000Z