rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-21447 
SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence platform (Web Intelligence HTML interface)
Published: 2021-01-12T14:40:43.000Z
CVE-2021-21448 
SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on the client PC and not via Network and the attacker needs at least user authorization of the Operating System user of the victim.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP GUI FOR WINDOWS
Published: 2021-01-12T14:40:29.000Z
CVE-2021-21449 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:40:09.000Z
CVE-2021-21450 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:39:59.000Z
CVE-2021-21451 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:38:55.000Z
CVE-2021-21452 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:38:39.000Z
CVE-2021-21453 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:39:52.000Z
CVE-2021-21454 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:39:07.000Z
CVE-2021-21455 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:38:49.000Z
CVE-2021-21456 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:40:33.000Z
CVE-2021-21457 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:40:37.000Z
CVE-2021-21458 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:40:04.000Z
CVE-2021-21459 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:38:15.000Z
CVE-2021-21460 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:38:28.000Z
CVE-2021-21461 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:40:24.000Z
CVE-2021-21462 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:40:48.000Z
CVE-2021-21463 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:41:55.000Z
CVE-2021-21464 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-01-12T14:39:03.000Z
CVE-2021-21465 
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.
Problem types: description: SQL Injection
Affected products: vendor: SAP SE
product: SAP Business Warehouse
Published: 2021-01-12T14:40:57.000Z
CVE-2021-21466 
SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Business Warehouse
vendor: SAP SE
product: SAP BW/4HANA
Published: 2021-01-12T14:42:39.000Z
CVE-2021-21467 
SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper authorization check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Banking Services (Generic Market Data)
Published: 2021-01-12T14:41:45.000Z
CVE-2021-21468 
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
Problem types: description: Missing Authorization check
Affected products: vendor: SAP SE
product: SAP Business Warehouse
Published: 2021-01-12T14:40:53.000Z
CVE-2021-21469 
When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any level (e.g., MDS Server password not set, network and OS configuration not properly secured, etc.), a malicious user might define UNC paths which could then be exploited to put the system at risk using a so-called SMB relay attack and obtain highly sensitive data, which leads to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver Master Data Management
Published: 2021-01-12T14:44:32.000Z
CVE-2021-21470 
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.
Problem types: description: XML External Entity Reference (XXE)
Affected products: vendor: SAP SE
product: SAP EPM Add-in for Microsoft Office
vendor: SAP SE
product: SAP EPM Add-in for SAP Analysis Office
Published: 2021-01-12T14:41:08.000Z
CVE-2021-21471 
In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.
Problem types: description: Improper Access Control
Affected products: vendor: SAP SE
product: CLA-Assistant
Published: 2021-01-12T14:21:12.000Z
CVE-2021-21472 
SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this allows an authenticated attacker to perform various security attacks like Directory Traversal, Password Brute force Attack, SMB Relay attack, Security Downgrade.
Problem types: description: Weak Password Requirements
Affected products: vendor: SAP SE
product: SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1)
Published: 2021-02-09T20:43:38.000Z
CVE-2021-21473 
SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver ABAP Platform.
Problem types: description: Missing Authorization
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP and ABAP Platform (SRM_RFC_SUBMIT_REPORT)
Published: 2021-06-09T13:23:48.000Z
CVE-2021-21474 
SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidating the digital signature, this allows them to impersonate as user in HANA database and be able to read the contents in the database.
Problem types: description: Improper Authentication
Affected products: vendor: SAP SE
product: SAP HANA Database
Published: 2021-02-09T20:44:04.000Z
CVE-2021-21475 
Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this Directory Traversal vulnerability the attacker could read content of arbitrary files on the remote server and expose sensitive data.
Problem types: description: Directory Traversal
Affected products: vendor: SAP SE
product: SAP NetWeaver Master Data Management Server
Published: 2021-02-09T20:43:48.000Z
CVE-2021-21476 
SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
Problem types: description: Tabnabbing
Affected products: vendor: SAP SE
product: SAP UI5
Published: 2021-02-09T20:44:32.000Z
CVE-2021-21477 
SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.
Problem types: description: Remote Code Execution
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2021-02-09T20:43:57.000Z
CVE-2021-21478 
SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
Problem types: description: Tabnabbing
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Web Dynpro ABAP)
Published: 2021-02-09T20:44:40.000Z
CVE-2021-21479 
In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.
Problem types: description: Remote Code Execution
Affected products: vendor: SAP SE
product: SCIMono
Published: 2021-02-09T20:49:20.000Z
CVE-2021-21480 
SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server, inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role, malicious content in the dashboard gets executed, leading to remote code execution in the server, which allows privilege escalation. The malicious JSP code can contain certain OS commands, through which an attacker can read sensitive files in the server, modify files or even delete contents in the server thus compromising the confidentiality, integrity and availability of the server hosting the SAP MII application. Also, an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application.
Problem types: description: Code Execution
Affected products: vendor: SAP SE
product: SAP Manufacturing Integration and Intelligence
Published: 2021-03-09T14:10:47.000Z
CVE-2021-21481 
The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.
Problem types: description: Missing Authorization
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (MigrationService)
Published: 2021-03-09T14:05:51.000Z
CVE-2021-21482 
SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed.
Problem types: description: Information disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver Master Data Management
Published: 2021-04-13T18:39:52.000Z
CVE-2021-21483 
Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the exploitable component thereby affecting the confidentiality in the application.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Solution Manager
Published: 2021-04-13T18:39:17.000Z
CVE-2021-21484 
LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind.
Problem types: description: Authentication Bypass
Affected products: vendor: SAP SE
product: SAP HANA
Published: 2021-03-09T14:11:24.000Z
CVE-2021-21485 
An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for JAVA (Telnet Commands)
Published: 2021-04-13T18:44:47.000Z
CVE-2021-21486 
SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Problem types: description: Missing Authorization check
Affected products: vendor: SAP SE
product: SAP Enterprise Financial Services (Bank Customer Accounts)
Published: 2021-03-09T14:07:48.000Z
CVE-2021-21487 
SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Problem types: description: Missing Authorization check
Affected products: vendor: SAP SE
product: SAP Payment Engine
Published: 2021-03-09T14:11:05.000Z
CVE-2021-21488 
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.
Problem types: description: Insecure Deserialization
Affected products: vendor: SAP SE
product: SAP NetWeaver Knowledge Management
Published: 2021-03-09T14:07:10.000Z
CVE-2021-21489 
SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with administrative privileges to store a malicious script on the portal. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of portal content.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal
Published: 2021-09-14T11:15:14.000Z
CVE-2021-21490 
SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data relating to the current session and use it to impersonate a user and access all information with the same rights as the target user.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for ABAP (Web Survey)
Published: 2021-06-09T13:23:40.000Z
CVE-2021-21491 
SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
Problem types: description: Reverse Tabnabbing
Affected products: vendor: SAP SE
product: SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java)
Published: 2021-03-10T14:11:46.000Z
CVE-2021-21492 
SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled.
Problem types: cwe_id: CWE-290
description: Content Spoofing (CWE-290)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for JAVA (HTTP Service)
Published: 2021-04-13T18:40:20.000Z
CVE-2021-21493 
When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-03-09T14:08:47.000Z
CVE-2021-21494 
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T02:05:34.000Z