CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21736 – Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)
https://notcve.org/view.php?id=CVE-2024-21736
SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application. SAP S/4HANA Finance for (Advanced Payment Management): versiones SAPSCORE 128, S4CORE 107, no realiza las comprobaciones de autorización necesarias. Se podría activar una importación de funciones que permitiera al atacante crear cuentas bancarias internas, lo que tendría un bajo impacto en la confidencialidad de la aplicación. • https://me.sap.com/notes/3260667 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-42475 – Information Disclosure Vulnerability in Statutory Reporting
https://notcve.org/view.php?id=CVE-2023-42475
The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality. La aplicación Statutory Reporting tiene una ubicación de almacenamiento de archivos vulnerable, lo que potencialmente permite a un atacante con pocos privilegios leer archivos del servidor con un impacto mínimo en la confidencialidad. • https://me.sap.com/notes/3222121 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •