CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2023-24529
https://notcve.org/view.php?id=CVE-2023-24529
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to hijack a user session, read and modify some sensitive information. • https://launchpad.support.sap.com/#/notes/3282663 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-21488
https://notcve.org/view.php?id=CVE-2021-21488
Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability. Knowledge Management versiones 7.01, 7.02, 7.30, 7.31, 7.40, 7.50, permiten a un atacante remoto con privilegios básicos deserializar unos datos controlados por el usuario sin comprobación, conllevando a una deserialización no segura que desencadena el código del atacante y, por lo tanto, afecta la Disponibilidad • https://launchpad.support.sap.com/#/notes/2983436 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-6263
https://notcve.org/view.php?id=CVE-2020-6263
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass. Los clientes dedicados que se conectan a SAP NetWeaver AS Java por medio del protocolo P4, versiones (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11 , 7.20, 7.30, 7.31, 7.40, 7.50), no realiza ninguna comprobación de autenticación para las operaciones que requieren identidad del usuario conllevando a una Omisión de Autenticación • https://launchpad.support.sap.com/#/notes/2878568 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.1EPSS: 0%CPEs: 11EXPL: 0CVE-2020-6225
https://notcve.org/view.php?id=CVE-2020-6225
SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently validate path information provided by users, thus characters representing traverse to parent directory are passed through to the file APIs, allowing the attacker to overwrite, delete, or corrupt arbitrary files on the remote server, leading to Path Traversal. SAP NetWeaver (Knowledge Management), versiones (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 y KMC-WPC 7.30, 7.31, 7.40, 7.50), no comprueba suficientemente la información de ruta proporcionada por los usuarios, por lo tanto los caracteres representan un salto al directorio padre que son pasados a través de las API de archivo, lo que permite a un atacante sobrescribir, eliminar o corromper archivos arbitrarios en el servidor remoto, conllevando a un Salto de Ruta. • https://launchpad.support.sap.com/#/notes/2896682 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 0CVE-2020-6205
https://notcve.org/view.php?id=CVE-2020-6205
SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content and/or steal authentication information of the user and/or impersonate the user and access all information with the same rights as the target user, leading to Reflected Cross Site Scripting Vulnerability. SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), versiones de SAP_BASIS 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; no codifica suficientemente las entradas controladas por el usuario, permitiendo a un atacante no autenticado desfigurar de forma no permanente o modificar el contenido mostrado y/o robar información de autenticación del usuario y/o suplantar al usuario y acceder a toda la información con los mismos derechos que el usuario objeto del ataque, conllevando a una Vulnerabilidad de tipo Cross Site Scripting Reflejado. • https://launchpad.support.sap.com/#/notes/2884910 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •