rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-2457 
Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP Adaptive Server Enterprise
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2458 
Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP Business One
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2459 
Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a different user.
Problem types: description: Information disclosure
Affected products: vendor: SAP
product: SAP Mobile Platform
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2460 
SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack.
Problem types: description: Insecure Certificate Verification
Affected products: vendor: SAP
product: SAP Business One Android application
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2461 
Missing authorization check in SAP HCM Fiori "People Profile" (GBX01 HR version 6.0) for an authenticated user which may result in an escalation of privileges.
Problem types: description: Missing Authorization
Affected products: vendor: SAP
product: GBX01 HR
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2462 
In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31. 7.40, 7.41, 7.50, does not sufficiently validate an XML document accepted from an untrusted source.
Problem types: description: XML Validation
Affected products: vendor: SAP
product: SAP NetWeaver BI
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2463 
The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC.
Problem types: description: Server-Side Request Forgery (SSRF)
Affected products: vendor: SAP
product: SAP Hybris Commerce
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2464 
SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP WebDynpro
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2465 
SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hacker can cause the database server to crash.
Problem types: description: Denial of Service
Affected products: vendor: SAP
product: SAP HANA
Published: 2018-09-11T15:00:00.000Z
CVE-2018-2466 
In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP Data Services
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2467 
In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web Browser such as Chrome the system returns an error with the path of the used application server.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP BusinessObjects BI Platform Servers (Software Development Kit)
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2468 
Under certain conditions the backup server in SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP Adaptive Server Enterprise (ASE)
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2469 
Under certain conditions SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP Adaptive Server Enterprise (ASE)
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2470 
In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP NetWeaver Application Server for ABAP
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2471 
Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP BusinessObjects Business Intelligence Platform
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2472 
SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 (Web Intelligence DHTML client) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP BusinessObjects Business Intelligence Platform
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2473 
SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Problem types: description: Denial of Service
Affected products: vendor: SAP
product: SAP BusinessObjects Business Intelligence Platform Server
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2474 
SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: SAP
product: SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2)
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2475 
Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with other minor Kubernetes security issues, the missing network isolation theoretically can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the high impact of a potential exploitation in "Gardener" context. This was fixed in Gardener release 0.12.4.
Problem types: description: Missing network isolation
Affected products: vendor: SAP
product: project “Gardener”
Published: 2018-10-09T13:00:00.000Z
CVE-2018-2476 
Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.
Problem types: description: URL Redirection
Affected products: vendor: SAP
product: SAP NetWeaver (forums)
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2477 
Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source.
Problem types: description: Missing XML Validation
Affected products: vendor: SAP
product: Knowledge Management (XMLForms) in SAP NetWeaver
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2478 
An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40 and 7.50 to 7.53. Not all commands are possible, only those that can be executed by the <sid>adm user. The commands executed depend upon the privileges of the <sid>adm user.
Problem types: description: Other
Affected products: vendor: SAP
product: SAP Basis (TREX / BWA installation)
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2479 
SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP BusinessObjects Business Intelligence Platform (BIWorkspace)
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2481 
In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is used. By implementing such transaction code a malicious user may execute unauthorized transaction functionality.
Problem types: description: Other
Affected products: vendor: SAP
product: SAP_ABA
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2482 
SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Install the Mobile Secure Android client released in Mid-Oct 2018.
Problem types: description: Denial of Service
Affected products: vendor: SAP
product: SAP Mobile Secure Android Application
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2483 
HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing request method.
Problem types: description: Other
Affected products: vendor: SAP
product: SAP BusinessObjects Business Intelligence Platform
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2484 
SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Enterprise Financial Services (SAPSCORE)
vendor: SAP SE
product: SAP Enterprise Financial Services (S4CORE)
vendor: SAP SE
product: SAP Enterprise Financial Services (EA-FINSERV)
vendor: SAP SE
product: SAP Enterprise Financial Services (Bank/CFM)
Published: 2019-01-08T20:00:00.000Z
CVE-2018-2485 
It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
Problem types: description: Code Injection
Affected products: vendor: SAP
product: SAP Fiori Client
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2486 
SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP Marketing (UICUAN)
vendor: SAP
product: SAP Marketing (SAPSCORE)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2487 
SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in specific use cases, files within this zip file can land in different locations than the originally intended extraction point.
Problem types: description: Directory/Path Traversal
Affected products: vendor: SAP
product: SAP Disclosure Management
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2488 
It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori Client and cause the application to crash. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
Problem types: description: Denial of Service
Affected products: vendor: SAP
product: SAP Fiori Client
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2489 
Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP
product: SAP Fiori Client
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2490 
The broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
Problem types: description: Other
Affected products: vendor: SAP
product: SAP Fiori Client
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2491 
When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually run inside the built-in log viewer of the application in case user opens the viewer and taps on the hyperlink in the viewer. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
Problem types: description: Code Injection
Affected products: vendor: SAP
product: SAP Fiori Client
Published: 2018-11-13T20:00:00.000Z
CVE-2018-2492 
SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.
Problem types: description: Missing XML Validation
Affected products: vendor: SAP
product: SAP NetWeaver Application Server (Java Library)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2494 
Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP
product: SAP Basis (AS ABAP of SAP NetWeaver)
vendor: SAP
product: SAP Basis (ABAP Platform)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2497 
The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.
Problem types: description: Other
Affected products: vendor: SAP
product: SAP HANA
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2499 
A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash of an admin user.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Financial Consolidation Cube Designer (BOBJ_EADES)
Published: 2019-01-08T20:00:00.000Z
CVE-2018-2500 
Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP
product: SAP Mobile Secure for Android
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2502 
TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnerability. This has been fixed in SAP Business One Service Layer (B1_ON_HANA, versions 9.2, 9.3).
Problem types: description: Other
Affected products: vendor: SAP
product: SAP Business One Service Layer (B1_ON_HANA)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2503 
By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).
Problem types: description: Missing Authentication
Affected products: vendor: SAP
product: SAP NetWeaver AS Java (ServerCore)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2504 
SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP
product: SAP NetWeaver AS Java (ServerCore)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2505 
SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product. Fixed in versions (SAP Hybris Commerce, versions 6.2, 6.3, 6.4, 6.5, 6.6, 6.7).
Problem types: description: Code Injection
Affected products: vendor: SAP
product: SAP Commerce (SAP Hybris Commerce)
Published: 2018-12-11T23:00:00.000Z
CVE-2018-2560 
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Solaris accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N).
Problem types: description: Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Solaris accessible data.
Affected products: vendor: Oracle Corporation
product: Solaris Operating System
Published: 2018-01-18T02:00:00.000Z
CVE-2018-2561 
Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Problem types: description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server.
Affected products: vendor: Oracle Corporation
product: HTTP Server
Published: 2018-01-18T02:00:00.000Z
CVE-2018-2562 
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).
Problem types: description: Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data.
Affected products: vendor: Oracle Corporation
product: MySQL Server
Published: 2018-01-18T02:00:00.000Z
CVE-2018-2563 
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: LDAP Library). Supported versions that are affected are 10 and 11.3. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Problem types: description: Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Solaris.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Solaris accessible data as well as  unauthorized read access to a subset of Solaris accessible data.
Affected products: vendor: Oracle Corporation
product: Solaris Operating System
Published: 2018-04-19T02:00:00.000Z
CVE-2018-2564 
Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).
Problem types: description: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized read access to a subset of Oracle WebCenter Content accessible data.
Affected products: vendor: Oracle Corporation
product: WebCenter Content
Published: 2018-01-18T02:00:00.000Z