CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2023-30742 – Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2023-30742
SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the victim's session could then be modified or read by the attacker. • https://launchpad.support.sap.com/#/notes/3315971 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 15EXPL: 0CVE-2023-29188 – Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
https://notcve.org/view.php?id=CVE-2023-29188
SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data. • https://i7p.wdf.sap.corp/sap/support/notes/3315979 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0CVE-2023-29189 – HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2023-29189
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields • https://launchpad.support.sap.com/#/notes/3269352 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-23: Relative Path Traversal •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6249
https://notcve.org/view.php?id=CVE-2020-6249
The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection. El uso de un reporte del backend de administración dentro de SAP Master Data Governance, versiones - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; permite al atacante ejecutar consultas de base de datos diseñadas, exponiendo la base de datos del backend, conllevando a una Inyección SQL. • https://launchpad.support.sap.com/#/notes/2908560 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •