CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2022-39802 – SAP Manufacturing Execution Core 15.3 Path Traversal
https://notcve.org/view.php?id=CVE-2022-39802
11 Oct 2022 — SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended file path can be manipulated to allow arbitrary traversal of directories on the remote server. The file content within each directory can be read which may lead to information disclosure. SAP Manufacturing Execution - versiones 15.1, 15.2, 15.3, permite a un atacante explotar una comprobación insuficiente de un parámetro de petición de ruta de archivo.... • https://github.com/redrays-io/CVE-2022-39802 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27615
https://notcve.org/view.php?id=CVE-2021-27615
09 Jun 2021 — SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers in response can be exploited by the attacker to execute Cross-Site Scripting (XSS) attacks. SAP Manufacturing Execution: versiones 15.1, 1.5.2, 15.3, 15.4, no contienen algunos encabezados de seguridad HTTP en su respuesta HTTP. El atacante puede ser explotado por la falta de estos encabezados en respuesta para ejecutar ataques de tipo cross-site ... • https://launchpad.support.sap.com/#/notes/3030961 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-27600
https://notcve.org/view.php?id=CVE-2021-27600
13 Apr 2021 — SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be im... • https://launchpad.support.sap.com/#/notes/3024414 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •