rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-6256 
SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required authorizations, due to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Master Data Governance
Published: 2020-05-12T17:51:22.000Z
CVE-2020-6257 
SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (CMC and BI launchpad)
Published: 2020-05-12T17:53:05.000Z
CVE-2020-6258 
SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Identity Management
Published: 2020-05-12T17:57:25.000Z
CVE-2020-6259 
Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise
Published: 2020-05-12T17:56:15.000Z
CVE-2020-6260 
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist.
Problem types: description: Incomplete XML Validation
Affected products: vendor: SAP SE
product: SAP Solution Manager (Trace Analysis)
Published: 2020-06-10T12:44:06.000Z
CVE-2020-6261 
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired.
Problem types: description: Incomplete XML Validation
Affected products: vendor: SAP SE
product: SAP Solution Manager (Trace Analysis)
Published: 2020-07-01T12:55:50.000Z
CVE-2020-6262 
Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Application Server ABAP (ST-PI)
Published: 2020-05-12T17:51:57.000Z
CVE-2020-6263 
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.
Problem types: description: Authentication Bypass
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA
Published: 2020-06-10T12:44:43.000Z
CVE-2020-6264 
SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2020-06-10T12:45:10.000Z
CVE-2020-6265 
SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: SAP SE
product: SAP Commerce
vendor: SAP SE
product: SAP Commerce (Data Hub)
Published: 2020-06-09T18:24:14.000Z
CVE-2020-6266 
SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection.
Problem types: description: URL Redirection
Affected products: vendor: SAP SE
product: SAP Fiori for SAP S/4HANA
Published: 2020-06-10T12:51:58.000Z
CVE-2020-6267 
Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.
Problem types: cwe_id: CWE-1004
description: CWE-1004
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6268 
Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP ERP (Statutory Reporting for Insurance Companies)
Published: 2020-06-10T12:35:27.000Z
CVE-2020-6269 
Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-06-10T12:37:29.000Z
CVE-2020-6270 
SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user leading to wrong prices.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP (Banking Services)
Published: 2020-06-10T12:36:10.000Z
CVE-2020-6271 
SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data (files visible for technical administration users of the diagnostics agent).
Problem types: description: Missing XML Validation
Affected products: vendor: SAP SE
product: SAP Solution Manager (Problem Context Manager)
Published: 2020-06-10T12:38:29.000Z
CVE-2020-6272 
SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Commerce Cloud
Published: 2020-10-15T01:46:38.000Z
CVE-2020-6273 
SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticated user working with attachment service, allowing the attacker to delete attachments due to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP S/4 HANA (Fiori UI for General Ledger Accounting)
Published: 2020-08-12T13:19:40.000Z
CVE-2020-6275 
SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.
Problem types: description: Server Side Request Forgery
Affected products: vendor: SAP SE
product: SAP Netweaver AS ABAP
Published: 2020-06-10T12:39:02.000Z
CVE-2020-6276 
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (bipodata)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6278 
SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6280 
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver (ABAP Server) and ABAP Platform
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6281 
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (BI Launchpad)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6282 
SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE)
vendor: SAP SE
product: SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6283 
SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Fiori(Launchpad)
Published: 2020-09-09T12:51:11.000Z
CVE-2020-6284 
SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content could result in complete compromise of system confidentiality, integrity and availability, leading to Stored Cross Site Scripting.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP NetWeaver (Knowledge Management)
Published: 2020-08-12T13:21:04.000Z
CVE-2020-6285 
SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6286 
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
Problem types: description: Path Traversal
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (LM Configuration Wizard)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6287 
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Problem types: description: Missing Authentication Check
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (LM Configuration Wizard)
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6288 
SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)
Published: 2020-09-09T12:52:41.000Z
CVE-2020-6289 
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6290 
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.
Problem types: description: Session Fixation
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6291 
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
Problem types: description: Insufficient Session Expiration
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6292 
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.
Problem types: cwe_id: CWE-613
description: CWE-613
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-07-14T12:30:14.000Z
CVE-2020-6293 
SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access control lists and other upload file size restrictions, leading to Unrestricted File Upload.
Problem types: description: Unrestricted File Upload
Affected products: vendor: SAP SE
product: SAP NetWeaver (Knowledge Management)
Published: 2020-08-12T13:22:41.000Z
CVE-2020-6294 
Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity.
Problem types: description: Missing Authentication Check
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform
Published: 2020-08-12T13:27:19.000Z
CVE-2020-6295 
Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information through publicly readable installation log files leading to a compromise of the installed Cockpit. This compromise could enable the attacker to view, modify and/or make unavailable any data associated with the Cockpit, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Adaptive Server Enterprise
Published: 2020-08-12T13:28:28.000Z
CVE-2020-6296 
SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP NetWeaver (ABAP Server) and ABAP Platform
Published: 2020-08-12T13:34:40.000Z
CVE-2020-6297 
Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential system configuration information, that should otherwise be restricted, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Data Intelligence
Published: 2020-08-12T13:35:46.000Z
CVE-2020-6298 
SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GMD) and change related GMD key figure values, due to Missing Authorization Check.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Banking Services (Generic Market Data)
Published: 2020-08-12T13:41:55.000Z
CVE-2020-6299 
SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value help, leading to Information Disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver (ABAP Server) and ABAP Platform
Published: 2020-08-12T13:43:57.000Z
CVE-2020-6300 
SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end user (victim), as it does not sufficiently encode user-controlled inputs for RecycleBin, resulting in Stored Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross Site Scripting
Affected products: vendor: SAP SE
product: SAP Business Objects Business Intelligence Platform (Central Management Console)
Published: 2020-08-12T13:45:02.000Z
CVE-2020-6301 
SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check.
Problem types: description: Missing Authorization check
Affected products: vendor: SAP SE
product: SAP ERP (HCM Travel Management)
Published: 2020-08-12T13:50:55.000Z
CVE-2020-6302 
SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.
Problem types: cwe_id: CWE-384
description: CWE-384 (Session Fixation)
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2020-09-09T12:52:14.000Z
CVE-2020-6303 
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP Disclosure Management
Published: 2020-01-14T17:52:59.000Z
CVE-2020-6304 
Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP NetWeaver Internet Communication Manager (KRNL32NUC)
vendor: SAP SE
product: SAP NetWeaver Internet Communication Manager (KRNL32UC)
vendor: SAP SE
product: SAP NetWeaver Internet Communication Manager (KRNL64NUC)
vendor: SAP SE
product: SAP NetWeaver Internet Communication Manager (KRNL64UC)
vendor: SAP SE
product: SAP NetWeaver Internet Communication Manager (KERNEL)
Published: 2020-01-14T17:52:59.000Z
CVE-2020-6305 
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Problem types: description: Cross-Site Scripting
Affected products: vendor: SAP SE
product: SAP Process Integration - Rest Adapter (SAP_XIAF)
Published: 2020-01-14T17:52:59.000Z
CVE-2020-6306 
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17).
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Leasing (SAP_Appl)
vendor: SAP SE
product: SAP Leasing (EA_Appl)
Published: 2020-01-14T17:52:59.000Z
CVE-2020-6307 
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: Automated Note Search Tool (SAP Basis)
Published: 2020-01-14T17:52:59.000Z
CVE-2020-6308 
SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
Problem types: description: Server-Side Request Forgery
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Web Services)
Published: 2020-10-20T13:31:10.000Z
CVE-2020-6309 
SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service.
Problem types: description: Missing Authentication check
Affected products: vendor: SAP SE
product: SAP NetWeaver AS JAVA (ENGINEAPI)
vendor: SAP SE
product: SAP NetWeaver AS JAVA (WSRM)
vendor: SAP SE
product: SAP NetWeaver AS JAVA (J2EE-FRMW)
Published: 2020-08-12T13:51:59.000Z