CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0CVE-2023-29189 – HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2023-29189
SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields • https://launchpad.support.sap.com/#/notes/3269352 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-23: Relative Path Traversal •
CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 0CVE-2023-24525
https://notcve.org/view.php?id=CVE-2023-24525
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application. • https://launchpad.support.sap.com/#/notes/2788178 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6273
https://notcve.org/view.php?id=CVE-2020-6273
SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticated user working with attachment service, allowing the attacker to delete attachments due to Missing Authorization Check. SAP S/4 HANA (Fiori UI para General Ledger Accounting), versiones 103, 104, no lleva a cabo unas comprobaciones de autorización necesarias para un usuario autenticado que trabaja con el servicio attachment, permitiendo al atacante eliminar archivos adjuntos debido a una Falta de Comprobación de Autorización • https://launchpad.support.sap.com/#/notes/2885671 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-0388
https://notcve.org/view.php?id=CVE-2019-0388
SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insufficient URL validation. El controlador HTTP de SAP UI5 (corregido en SAP_UI versiones 7.5, 7.51, 7.52, 7.53, 7.54 y SAP UI_700 versión 2.0), permite a un atacante manipular el contenido debido a una comprobación de URL insuficiente. • https://launchpad.support.sap.com/#/notes/2843016 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2019-0245
https://notcve.org/view.php?id=CVE-2019-0245
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. SAP CRM WebClient UI (solucionado en SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) no valida suficientemente los campos ocultos controlados por el usuario, lo que resulta en una vulnerabilidad de Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/106468 https://launchpad.support.sap.com/#/notes/2588763 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •