rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-27602 
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Commerce
Published: 2021-04-13T18:41:24.000Z
CVE-2021-27603 
An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.
Problem types: description: Denial of Service
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for ABAP
Published: 2021-04-13T18:40:46.000Z
CVE-2021-27604 
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.
Problem types: cwe_id: CWE-611
description: XML External Entity (CWE-611)
Affected products: vendor: SAP SE
product: SAP Process Integration (Enterprise Service Repository JAVA Mappings)
Published: 2021-04-14T14:22:16.000Z
CVE-2021-27605 
SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last name, first name of the employees, so there is some loss of confidential information, Integrity and Availability are not impacted.
Problem types: description: Missing Authorization
Affected products: vendor: SAP SE
product: SAP Fiori Apps 2.0 for Travel Management in SAP ERP
Published: 2021-04-13T18:44:13.000Z
CVE-2021-27606 
SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncOAMParamStore() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-125
description: Improper Input Validation (CWE-125)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27607 
SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThSncIn() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-476
description: Improper Input Validation (CWE-476)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27608 
An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable file is registered. This could further lead to complete compromise of confidentiality, Integrity and Availability.
Problem types: description: Unquoted Search Path or Element (CWE - 428)
Affected products: vendor: SAP SE
product: SAP Setup
Published: 2021-04-14T14:23:21.000Z
CVE-2021-27609 
SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP EarlyWatch Alert service data collection and sending to SAP without the intended authorization.
Problem types: description: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Focused RUN
Published: 2021-04-13T18:45:06.000Z
CVE-2021-27610 
SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system.
Problem types: description: Improper Authentication
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP and ABAP Platform
Published: 2021-06-16T14:45:57.000Z
CVE-2021-27611 
SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27612 
In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim.
Problem types: description: URL Redirection to Untrusted Site
Affected products: vendor: SAP SE
product: SAP GUI for Windows
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27613 
Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure temporary folder for incoming & outgoing payroll data and to access information which would otherwise be restricted, which could lead to Information Disclosure and highly impact system confidentiality, integrity and availability.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business One (Cookbooks)
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27614 
SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application thereby highly impacting the integrity and availability of the application.
Problem types: description: Code Injection
Affected products: vendor: SAP SE
product: SAP Business One, version for SAP HANA (Cookbooks)
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27615 
SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers in response can be exploited by the attacker to execute Cross-Site Scripting (XSS) attacks.
Problem types: description: Cross-Site Scripting (XSS)
Affected products: vendor: SAP SE
product: SAP Manufacturing Execution
Published: 2021-06-09T13:25:03.000Z
CVE-2021-27616 
Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows an attacker to exploit an insecure temporary backup path and to access information which would otherwise be restricted, resulting in Information Disclosure vulnerability highly impacting the confidentiality, integrity and availability of the application.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Business One, version for SAP HANA (Cookbooks)
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27617 
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to Denial-of-service conditions due to consumption of a large amount of system memory, thus highly impacting system availability.
Problem types: description: Missing XML Validation
Affected products: vendor: SAP SE
product: SAP Process Integration (Integration Builder Framework)
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27618 
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and upload it to the application, which could lead to denial of service and impact the availability of the application.
Problem types: description: Unrestricted File Upload
Affected products: vendor: SAP SE
product: SAP Process Integration (Integration Builder Framework)
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27619 
SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be displayed to them. Although the search results are masked, the user can iteratively enter one character at a time to search and determine the masked attribute value thereby leading to information disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Commerce (Backoffice Search)
Published: 2021-05-11T14:19:33.000Z
CVE-2021-27620 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method Ups::AddPart() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27621 
Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for Java (UserAdmin)
Published: 2021-06-09T13:25:25.000Z
CVE-2021-27622 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CDrawRaster::LoadImageFromMemory() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27623 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CXmlUtility::CheckLength() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27624 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CiXMLIStreamRawBuffer::readRaw () which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27625 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method IgsData::freeMemory() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27626 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CMiniXMLParser::Parse() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27627 
SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method ChartInterpreter::DoIt() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP Internet Graphics Service
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27628 
SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method DpRTmPrepareReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27629 
SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncPSetUnsupported() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-125
description: Improper Input Validation (CWE-125)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27630 
SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-476
description: Improper Input Validation (CWE-476)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27631 
SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-476
description: Improper Input Validation (CWE-476)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27632 
SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EnqConvUniToSrvReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-476
description: Improper Input Validation (CWE-476)
Affected products: vendor: SAP SE
product: SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27633 
SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCPIC() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for ABAP (RFC Gateway)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27634 
SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCpicDtCreate () causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Problem types: cwe_id: CWE-787
description: Improper Input Validation (CWE-787)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for ABAP (RFC Gateway)
Published: 2021-06-09T00:00:00.000Z
CVE-2021-27635 
SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation, this vulnerability enables attacker to fully compromise confidentiality by allowing them to read any file on the filesystem or fully compromise availability by causing the system to crash. The attack cannot be used to change any data so that there is no compromise as to integrity.
Problem types: description: Missing XML Validation (CWE - 112)
Affected products: vendor: SAP SE
product: SAP NetWeaver AS for JAVA
Published: 2021-06-09T13:30:45.000Z
CVE-2021-27637 
Under certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager), versions - 1.0, 10 allows an attacker to access information which would otherwise be restricted leading to information disclosure.
Problem types: description: Information Disclosure
Affected products: vendor: SAP SE
product: SAP Enable Now (SAP Workforce Performance Builder - Manager)
Published: 2021-06-09T13:30:33.000Z
CVE-2021-27638 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:31:33.000Z
CVE-2021-27639 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:30:39.000Z
CVE-2021-27640 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:31:52.000Z
CVE-2021-27641 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:31:41.000Z
CVE-2021-27642 
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Problem types: description: Improper Input Validation
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2021-06-09T13:31:57.000Z