rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-6204 
The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)
vendor: SAP SE
product: SAP Treasury and Risk Management (Transaction Management) (S4CORE)
Published: 2020-03-10T20:20:12.000Z
CVE-2020-6205 
SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content and/or steal authentication information of the user and/or impersonate the user and access all information with the same rights as the target user, leading to Reflected Cross Site Scripting Vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS
Published: 2020-03-10T20:20:21.000Z
CVE-2020-6206 
SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery.
Problem types: description: Cross Site Request Forgery
Affected products: vendor: SAP SE
product: SAP Cloud Platform Integration for Data Services
Published: 2020-03-10T20:20:28.000Z
CVE-2020-6207 
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
Problem types: description: Missing Authentication Check
Affected products: vendor: SAP SE
product: SAP Solution Manager (User Experience Monitoring)
Published: 2020-03-10T20:20:36.000Z
CVE-2020-6208 
SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.
Problem types: description: Remote Code Execution
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Crystal Reports)
Published: 2020-03-10T20:20:44.000Z
CVE-2020-6209 
SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-03-10T20:20:54.000Z
CVE-2020-6210 
SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Fiori Launchpad
Published: 2020-03-10T20:21:04.000Z
CVE-2020-6211 
SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.
Problem types: description: URL Redirection
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-04-14T19:42:11.000Z
CVE-2020-6212 
Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user, allowing reading or modification of some tax reports, due to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP ERP
vendor: SAP SE
product: SAP S/4 HANA
Published: 2020-04-24T22:18:54.000Z
CVE-2020-6213 
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled inputs.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_PHTMLB)
Published: 2020-04-24T22:17:15.000Z
CVE-2020-6214 
SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects, exploitation of the vulnerability would allow an authenticated attacker to view, change, or delete data, thereby preventing the proper segregation of duties in the system.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: SAP SE
product: SAP S/4HANA (Financial Products Subledger)
Published: 2020-04-14T18:05:32.000Z
CVE-2020-6215 
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.
Problem types: description: URL Redirection
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Business Server Pages Test Application IT00)
Published: 2020-04-14T00:00:00.000Z
CVE-2020-6216 
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (BI Launchpad)
Published: 2020-04-14T18:07:42.000Z
CVE-2020-6217 
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Business Server Pages Test Application IT05)
Published: 2020-04-14T19:41:34.000Z
CVE-2020-6218 
Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-04-14T18:06:37.000Z
CVE-2020-6219 
SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service and unauthorized execution of arbitrary commands, leading to Deserialization of Untrusted Data.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)
vendor: SAP SE
product: Crystal Reports for VS
Published: 2020-04-14T18:19:18.000Z
CVE-2020-6220 
BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2022-06-06T19:45:13.000Z
CVE-2020-6221 
Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform
Published: 2020-04-14T18:07:18.000Z
CVE-2020-6222 
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2020-04-14T18:18:10.000Z
CVE-2020-6223 
The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content. This can misdirect a user who is tricked into accessing these error pages rendered by the application, leading to Content Spoofing.
Problem types: description: Content Spoofing
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-04-14T18:07:00.000Z
CVE-2020-6224 
SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver AS Java (HTTP Service)
Published: 2020-04-14T18:31:46.000Z
CVE-2020-6225 
SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently validate path information provided by users, thus characters representing traverse to parent directory are passed through to the file APIs, allowing the attacker to overwrite, delete, or corrupt arbitrary files on the remote server, leading to Path Traversal.
Problem types: description: Path Traversal
Affected products: vendor: SAP SE
product: SAP NetWeaver (Knowledge Management) (KMC-CM)
vendor: SAP SE
product: SAP NetWeaver (Knowledge Management) (KMC-WPC)
Published: 2020-04-14T19:40:25.000Z
CVE-2020-6226 
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2020-04-14T18:33:26.000Z
CVE-2020-6227 
SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (CMS / Auditing issues)
Published: 2020-04-14T18:19:57.000Z
CVE-2020-6228 
SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify the installer.
Problem types: description: Other
Affected products: vendor: SAP SE
product: SAP Business Client
Published: 2020-04-14T18:32:25.000Z
CVE-2020-6229 
SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not sufficiently encode user controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME)
Published: 2020-04-14T18:20:21.000Z
CVE-2020-6230 
SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP OrientDB
Published: 2020-04-14T18:34:07.000Z
CVE-2020-6231 
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2020-04-14T18:32:57.000Z
CVE-2020-6232 
SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects confidentiality of secure media.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2020-04-14T18:37:46.000Z
CVE-2020-6233 
SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analysis report due to Missing Authorization Check, resulting in slowing the system.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL)
vendor: SAP SE
product: SAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL)
Published: 2020-04-14T18:34:47.000Z
CVE-2020-6234 
SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating system, leading to Privilege Escalation.
Problem types: description: Privilege Escalation
Affected products: vendor: SAP SE
product: SAP Host Agent
Published: 2020-04-14T18:38:12.000Z
CVE-2020-6235 
SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to Missing Authentication.
Problem types: description: Missing authentication
Affected products: vendor: SAP SE
product: SAP Solution Manager (Diagnostics Agent)
Published: 2020-04-14T18:36:26.000Z
CVE-2020-6236 
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation.
Problem types: description: Privilege Escalation
Affected products: vendor: SAP SE
product: SAP Landscape Management
vendor: SAP SE
product: SAP Adaptive Extensions
Published: 2020-04-14T18:38:43.000Z
CVE-2020-6237 
Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-04-14T18:36:58.000Z
CVE-2020-6238 
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.
Problem types: description: Missing XML Validation
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2020-04-14T18:39:02.000Z
CVE-2020-6239 
Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business One (Backup service)
Published: 2020-06-10T12:33:30.000Z
CVE-2020-6240 
SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)
vendor: SAP SE
product: SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)
Published: 2020-05-12T17:46:58.000Z
CVE-2020-6241 
SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection.
Problem types: description: SQL Injection
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise
Published: 2020-05-12T17:56:40.000Z
CVE-2020-6242 
SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check.
Problem types: description: Missing Authentication Check
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Live Data Connect)
Published: 2020-05-12T17:58:06.000Z
CVE-2020-6243 
Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise (XP Server on Windows Platform)
Published: 2020-05-12T17:47:46.000Z
CVE-2020-6244 
SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: SAP SE
product: SAP Business Client
Published: 2020-05-12T17:54:36.000Z
CVE-2020-6245 
SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers.
Problem types: cwe_id: CWE-99
description: CWE-99
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-05-12T17:49:07.000Z
CVE-2020-6246 
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_TABLE)
Published: 2020-06-10T12:34:37.000Z
CVE-2020-6247 
SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability.
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-05-12T17:49:28.000Z
CVE-2020-6248 
SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise (Backup Server)
Published: 2020-05-12T17:50:57.000Z
CVE-2020-6249 
The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.
Problem types: description: SQL Injection
Affected products: vendor: SAP SE
product: SAP Master Data Governance (S4CORE)
vendor: SAP SE
product: SAP Master Data Governance (S4FND)
vendor: SAP SE
product: SAP Master Data Governance (SAP_BS_FND)
Published: 2020-05-12T17:48:30.000Z
CVE-2020-6250 
SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop the server like an administrator.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise
Published: 2020-05-12T17:52:19.000Z
CVE-2020-6251 
Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform
Published: 2020-05-12T17:50:16.000Z
CVE-2020-6252 
Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact system availability.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise (Cockpit)
Published: 2020-05-12T17:55:34.000Z
CVE-2020-6253 
Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries to elevate their privileges, modify database objects, or execute commands they are not otherwise authorized to execute, leading to SQL Injection.
Problem types: description: SQL Injection
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise (Web Services)
Published: 2020-05-12T17:55:06.000Z
CVE-2020-6254 
SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Enterprise Threat Detection
Published: 2020-05-12T17:57:06.000Z