rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-33697 
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.
Problem types: cwe_id: CWE-1022
description: CWE-1022: Use of Web Link to Untrusted Target (Reverse Tabnabbing)
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (SAPUI5)
Published: 2021-09-15T18:01:46.000Z
CVE-2021-33698 
SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format validation.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-09-15T18:01:53.000Z
CVE-2021-33699 
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Task Control features. This allows an unauthorized attacker or malware to takeover legitimate apps and to steal user's sensitive information.
Problem types: description: Task Hijacking
Affected products: vendor: SAP SE
product: SAP Fiori Client Native Mobile for Android
Published: 2021-08-10T14:07:53.000Z
CVE-2021-33700 
SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sensitive information which the attacker could use to take substantial control of the vulnerable application.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-09-15T18:01:51.000Z
CVE-2021-33701 
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection�)
Affected products: vendor: SAP SE
product: DMIS Mobile Plug-In
vendor: SAP SE
product: SAP S/4HANA
Published: 2021-09-15T18:01:55.000Z
CVE-2021-33702 
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets executed in the victim's browser, resulting in a Stored Cross-Site Scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal
Published: 2021-08-10T14:08:12.000Z
CVE-2021-33703 
Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal (Application Extensions)
Published: 2021-08-10T14:08:06.000Z
CVE-2021-33704 
The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover the vulnerable function, no in-depth system knowledge is required. Once exploited via Network stack, the attacker may be able to read, modify or delete restricted data. The impact is that missing authorization can result of abuse of functionality usually restricted to specific users.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization Check
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2021-09-15T18:01:56.000Z
CVE-2021-33705 
The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal
Published: 2021-09-15T18:01:52.000Z
CVE-2021-33706 
Due to improper input validation in InfraBox, logs can be modified by an authenticated user.
Problem types: description: Improper input validation
Affected products: vendor: SAP SE
product: InfraBox
Published: 2021-08-10T14:10:54.000Z
CVE-2021-33707 
SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: SAP SE
product: SAP NetWeaver (Knowledge Management)
Published: 2021-08-10T14:07:59.000Z
CVE-2021-33708 
Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges.
Problem types: description: Improper input validation
Affected products: vendor: SAP SE
product: Kyma
Published: 2021-08-10T19:25:02.000Z
CVE-2021-33709 
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). By sending malformed requests, a remote attacker could leak an application token due to an error not properly handled by the system.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: Teamcenter Active Workspace V4
vendor: Siemens
product: Teamcenter Active Workspace V5.0
vendor: Siemens
product: Teamcenter Active Workspace V5.1
Published: 2021-07-13T11:03:00.000Z
CVE-2021-33710 
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Teamcenter Active Workspace V4
vendor: Siemens
product: Teamcenter Active Workspace V5.0
vendor: Siemens
product: Teamcenter Active Workspace V5.1
Published: 2021-07-13T11:03:01.000Z
CVE-2021-33711 
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application allows verbose error messages which allow leaking of sensitive information, such as full paths.
Problem types: cwe_id: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
Affected products: vendor: Siemens
product: Teamcenter Active Workspace V4
vendor: Siemens
product: Teamcenter Active Workspace V5.0
vendor: Siemens
product: Teamcenter Active Workspace V5.1
Published: 2021-07-13T11:03:02.000Z
CVE-2021-33712 
A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). The configuration of the SAML module does not properly check various restrictions and validations imposed by an identity provider. This could allow a remote authenticated attacker to escalate privileges.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: Siemens
product: Mendix SAML Module
Published: 2021-06-08T19:47:17.000Z
CVE-2021-33713 
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files, a hash function is called with an incorrect argument leading the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
Problem types: cwe_id: CWE-688
description: CWE-688: Function Call With Incorrect Variable or Reference as Argument
Affected products: vendor: Siemens
product: JT Utilities
Published: 2021-07-13T11:03:03.000Z
CVE-2021-33714 
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files, a missing check for the validity of an iterator leads to NULL pointer deference condition, causing the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Siemens
product: JT Utilities
Published: 2021-07-13T11:03:04.000Z
CVE-2021-33715 
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). When parsing specially crafted JT files, a race condition could cause an object to be released before being operated on, leading to NULL pointer deference condition and causing the application to crash. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Siemens
product: JT Utilities
Published: 2021-07-13T11:03:05.000Z
CVE-2021-33716 
A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545-1 (All versions < V1.1). An attacker with access to the subnet of the affected device could retrieve sensitive information stored in cleartext.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: Siemens
product: SIMATIC CP 1543-1 (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC CP 1545-1
Published: 2021-09-14T10:47:34.000Z
CVE-2021-33717 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.1), Teamcenter Visualization (All versions < V13.2.0.1). When parsing specially crafted CGM Files, a NULL pointer deference condition could cause the application to crash. The application must be restarted to restore the service. An attacker could leverage this vulnerability to cause a Denial-of-Service condition in the application.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-08-10T10:35:31.000Z
CVE-2021-33718 
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.22), Mendix Applications using Mendix 8 (All versions < V8.18.7), Mendix Applications using Mendix 9 (All versions < V9.3.0). Write access checks of attributes of an object could be bypassed, if user has a write permissions to the first attribute of this object.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Siemens
product: Mendix Applications using Mendix 7
vendor: Siemens
product: Mendix Applications using Mendix 8
vendor: Siemens
product: Mendix Applications using Mendix 9
Published: 2021-07-13T11:03:06.000Z
CVE-2021-33719 
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Specially crafted packets sent to port 4443/tcp could cause a Denial-of-Service condition or potential remote code execution.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP050
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP100
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP300
Published: 2021-09-14T10:47:35.000Z
CVE-2021-33720 
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Specially crafted packets sent to port 4443/tcp could cause a Denial-of-Service condition.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP050
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP100
vendor: Siemens
product: SIPROTEC 5 relays with CPU variants CP300
Published: 2021-09-14T10:47:36.000Z
CVE-2021-33721 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating batch operations which could lead to command injection. An authenticated remote attacker with administrative privileges could exploit this vulnerability to execute arbitrary code on the system with system privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-08-10T10:35:32.000Z
CVE-2021-33722 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:23.000Z
CVE-2021-33723 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:24.000Z
CVE-2021-33724 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability that possibly allows to delete an arbitrary file or directory under a user controlled path.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:25.000Z
CVE-2021-33725 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:26.000Z
CVE-2021-33726 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:27.000Z
CVE-2021-33727 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:27.000Z
CVE-2021-33728 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:28.000Z
CVE-2021-33729 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:29.000Z
CVE-2021-33730 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:30.000Z
CVE-2021-33731 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:31.000Z
CVE-2021-33732 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:32.000Z
CVE-2021-33733 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:33.000Z
CVE-2021-33734 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:34.000Z
CVE-2021-33735 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:34.000Z
CVE-2021-33736 
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: SINEC NMS
Published: 2021-10-12T09:49:35.000Z
CVE-2021-33737 
A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 ERPC (All versions), SIMATIC CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 Advanced (All versions < V3.3), SIPLUS NET CP 443-1 (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (All versions < V3.3). Sending a specially crafted packet to port 102/tcp of an affected device could cause a denial of service condition. A restart is needed to restore normal operations.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens
product: SIMATIC CP 343-1 (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC CP 343-1 Advanced (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC CP 343-1 ERPC
default_status: unknown
vendor: Siemens
product: SIMATIC CP 343-1 Lean (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC CP 443-1
default_status: unknown
vendor: Siemens
product: SIMATIC CP 443-1
default_status: unknown
vendor: Siemens
product: SIMATIC CP 443-1 Advanced
default_status: unknown
vendor: Siemens
product: SIPLUS NET CP 443-1
default_status: unknown
vendor: Siemens
product: SIPLUS NET CP 443-1 Advanced
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-09-14T10:47:38.000Z
CVE-2021-33738 
A vulnerability has been identified in JT2Go (All versions < V13.2.0.2), Teamcenter Visualization (All versions < V13.2.0.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13405)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization
Published: 2021-08-10T10:35:33.000Z