Archive
10 September 2024
Vulnerabilities first published on this day (UTC), newest first.
97 results · Clear filters · Feed
-
Medium 4.7
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted U…
-
Medium 5.4
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application.
-
Medium 4.3
Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution)
Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. …
-
Medium 6.5
Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)
Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauthorized access that could lead to disclosure of highly sensitive data. There is no impact on integ…
-
Medium 4.3
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on int…
-
Medium 4.3
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on …
-
Medium 4.3
Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer)
Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limit…
-
Medium 4.3
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality o…
-
Medium 6.1
Cross-Site Scripting (XSS) in eProcurement on S/4HANA
Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the …
-
Medium 5.4
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes. There is low impact on i…
-
Medium 4.3
Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)
Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confiden…
-
Medium 5.3
An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web auth…
-
Medium 6.1CVE-2024-34831 Public exploit
cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the i…
-
Medium 6.1
eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code …
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in th…
-
Medium 5.9
An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exyno…
-
Medium 5.9
An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exyno…