diff --git a/2020/12xxx/CVE-2020-12823.json b/2020/12xxx/CVE-2020-12823.json index f49c169f612..e334561002f 100644 --- a/2020/12xxx/CVE-2020-12823.json +++ b/2020/12xxx/CVE-2020-12823.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-12823", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-12823", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://gitlab.com/openconnect/openconnect/-/merge_requests/108", + "refsource": "MISC", + "name": "https://gitlab.com/openconnect/openconnect/-/merge_requests/108" + }, + { + "url": "https://bugs.gentoo.org/721570", + "refsource": "MISC", + "name": "https://bugs.gentoo.org/721570" } ] } diff --git a/2020/12xxx/CVE-2020-12824.json b/2020/12xxx/CVE-2020-12824.json new file mode 100644 index 00000000000..3b23a1a5210 --- /dev/null +++ b/2020/12xxx/CVE-2020-12824.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-12824", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2020/12xxx/CVE-2020-12825.json b/2020/12xxx/CVE-2020-12825.json new file mode 100644 index 00000000000..96006716b93 --- /dev/null +++ b/2020/12xxx/CVE-2020-12825.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2020-12825", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://gitlab.gnome.org/GNOME/libcroco/-/issues/8", + "refsource": "MISC", + "name": "https://gitlab.gnome.org/GNOME/libcroco/-/issues/8" + } + ] + } +} \ No newline at end of file diff --git a/2020/1xxx/CVE-2020-1746.json b/2020/1xxx/CVE-2020-1746.json index 735731b61b4..00b42e86162 100644 --- a/2020/1xxx/CVE-2020-1746.json +++ b/2020/1xxx/CVE-2020-1746.json @@ -4,7 +4,8 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-1746", - "ASSIGNER": "msiddiqu@redhat.com" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" }, "affects": { "vendor": { @@ -67,7 +68,7 @@ "url": "https://github.com/ansible/ansible/pull/67866", "name": "https://github.com/ansible/ansible/pull/67866", "refsource": "CONFIRM" - } + } ] }, "description": { @@ -88,4 +89,4 @@ ] ] } -} +} \ No newline at end of file diff --git a/2020/6xxx/CVE-2020-6240.json b/2020/6xxx/CVE-2020-6240.json index e7aa30990c9..8ed8c5fe0af 100644 --- a/2020/6xxx/CVE-2020-6240.json +++ b/2020/6xxx/CVE-2020-6240.json @@ -4,14 +4,110 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6240", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "750" + }, + { + "version_name": "<", + "version_value": "752" + }, + { + "version_name": "<", + "version_value": "753" + }, + { + "version_name": "<", + "version_value": "754" + } + ] + } + }, + { + "product_name": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "700" + }, + { + "version_name": "<", + "version_value": "710" + }, + { + "version_name": "<", + "version_value": "730" + }, + { + "version_name": "<", + "version_value": "731" + }, + { + "version_name": "<", + "version_value": "804" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service" + } + ] + }, + "impact": { + "cvss": { + "baseScore": "5.3", + "vectorString": "CVSS:/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Denial of Service" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://launchpad.support.sap.com/#/notes/2856923", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2856923" + }, + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" } ] } diff --git a/2020/6xxx/CVE-2020-6241.json b/2020/6xxx/CVE-2020-6241.json index 95d576de8ea..dd9d9296a3b 100644 --- a/2020/6xxx/CVE-2020-6241.json +++ b/2020/6xxx/CVE-2020-6241.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6241", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "8.8", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "SQL Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2916927", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2916927" } ] } diff --git a/2020/6xxx/CVE-2020-6242.json b/2020/6xxx/CVE-2020-6242.json index 38d470204fe..e7d6f54202b 100644 --- a/2020/6xxx/CVE-2020-6242.json +++ b/2020/6xxx/CVE-2020-6242.json @@ -4,14 +4,79 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6242", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business Objects Business Intelligence Platform (Live Data Connect)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "1.0" + }, + { + "version_name": "<", + "version_value": "2.0" + }, + { + "version_name": "<", + "version_value": "2.x" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.x, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "9.8", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Missing Authentication Check" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2885244", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2885244" } ] } diff --git a/2020/6xxx/CVE-2020-6243.json b/2020/6xxx/CVE-2020-6243.json index 0f4fd57f317..ffc46e3dfc4 100644 --- a/2020/6xxx/CVE-2020-6243.json +++ b/2020/6xxx/CVE-2020-6243.json @@ -4,14 +4,75 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6243", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise (XP Server on Windows Platform)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "15.7" + }, + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "8.0", + "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Code Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://launchpad.support.sap.com/#/notes/2915585", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2915585" + }, + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" } ] } diff --git a/2020/6xxx/CVE-2020-6244.json b/2020/6xxx/CVE-2020-6244.json index 063a4ac74f7..c8d9e768c22 100644 --- a/2020/6xxx/CVE-2020-6244.json +++ b/2020/6xxx/CVE-2020-6244.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6244", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business Client", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "7.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "7.0", + "vectorString": "CVSS:/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-427" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2911801", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2911801" } ] } diff --git a/2020/6xxx/CVE-2020-6245.json b/2020/6xxx/CVE-2020-6245.json index 8b85def93af..ba22b17e677 100644 --- a/2020/6xxx/CVE-2020-6245.json +++ b/2020/6xxx/CVE-2020-6245.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6245", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business Objects Business Intelligence Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "4.2" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "6.5", + "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-99" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2828558", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2828558" } ] } diff --git a/2020/6xxx/CVE-2020-6247.json b/2020/6xxx/CVE-2020-6247.json index 75ef7bfc621..3db87ed2dc9 100644 --- a/2020/6xxx/CVE-2020-6247.json +++ b/2020/6xxx/CVE-2020-6247.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6247", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business Objects Business Intelligence Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "4.2" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "5.9", + "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Denial of Service" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2828558", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2828558" } ] } diff --git a/2020/6xxx/CVE-2020-6248.json b/2020/6xxx/CVE-2020-6248.json index 579ccdd7dd2..e6e399e6b2e 100644 --- a/2020/6xxx/CVE-2020-6248.json +++ b/2020/6xxx/CVE-2020-6248.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6248", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise (Backup Server)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "9.1", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Code Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2917275", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2917275" } ] } diff --git a/2020/6xxx/CVE-2020-6249.json b/2020/6xxx/CVE-2020-6249.json index 314a4003c71..4f7b2947d49 100644 --- a/2020/6xxx/CVE-2020-6249.json +++ b/2020/6xxx/CVE-2020-6249.json @@ -4,14 +4,101 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6249", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Master Data Governance (S4CORE)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "101" + } + ] + } + }, + { + "product_name": "SAP Master Data Governance (S4FND)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "102" + }, + { + "version_name": "<", + "version_value": "103" + }, + { + "version_name": "<", + "version_value": "104" + } + ] + } + }, + { + "product_name": "SAP Master Data Governance (SAP_BS_FND)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "748" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "7.7", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "SQL Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2908560", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2908560" } ] } diff --git a/2020/6xxx/CVE-2020-6250.json b/2020/6xxx/CVE-2020-6250.json index e6e1fe085ba..6a6d8e88ace 100644 --- a/2020/6xxx/CVE-2020-6250.json +++ b/2020/6xxx/CVE-2020-6250.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6250", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop the server like an administrator." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "6.8", + "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information Disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2917022", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2917022" } ] } diff --git a/2020/6xxx/CVE-2020-6251.json b/2020/6xxx/CVE-2020-6251.json index 3ab4281f3d9..8968d5006ec 100644 --- a/2020/6xxx/CVE-2020-6251.json +++ b/2020/6xxx/CVE-2020-6251.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6251", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP BusinessObjects Business Intelligence Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "4.2" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "4.3", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information Disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2828558", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2828558" } ] } diff --git a/2020/6xxx/CVE-2020-6252.json b/2020/6xxx/CVE-2020-6252.json index 3b8354d804a..cb30526db4c 100644 --- a/2020/6xxx/CVE-2020-6252.json +++ b/2020/6xxx/CVE-2020-6252.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6252", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise (Cockpit)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact system availability." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "9.0", + "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information Disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2917090", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2917090" } ] } diff --git a/2020/6xxx/CVE-2020-6253.json b/2020/6xxx/CVE-2020-6253.json index 0f66a4c69a2..e6888b0f7d9 100644 --- a/2020/6xxx/CVE-2020-6253.json +++ b/2020/6xxx/CVE-2020-6253.json @@ -4,14 +4,75 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6253", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise (Web Services)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "15.7" + }, + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries to elevate their privileges, modify database objects, or execute commands they are not otherwise authorized to execute, leading to SQL Injection." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "7.2", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "SQL Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2917273", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2917273" } ] } diff --git a/2020/6xxx/CVE-2020-6254.json b/2020/6xxx/CVE-2020-6254.json index 1b2181429d6..3326e10569f 100644 --- a/2020/6xxx/CVE-2020-6254.json +++ b/2020/6xxx/CVE-2020-6254.json @@ -4,14 +4,75 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6254", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Enterprise Threat Detection", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "1.0" + }, + { + "version_name": "<", + "version_value": "2.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "6.1", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2913293", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2913293" } ] } diff --git a/2020/6xxx/CVE-2020-6256.json b/2020/6xxx/CVE-2020-6256.json index d4dfd7e28c3..7565992a600 100644 --- a/2020/6xxx/CVE-2020-6256.json +++ b/2020/6xxx/CVE-2020-6256.json @@ -4,14 +4,107 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6256", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Master Data Governance", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "748" + }, + { + "version_name": "<", + "version_value": "749" + }, + { + "version_name": "<", + "version_value": "750" + }, + { + "version_name": "<", + "version_value": "751" + }, + { + "version_name": "<", + "version_value": "752" + }, + { + "version_name": "<", + "version_value": "800" + }, + { + "version_name": "<", + "version_value": "801" + }, + { + "version_name": "<", + "version_value": "802" + }, + { + "version_name": "<", + "version_value": "803" + }, + { + "version_name": "<", + "version_value": "804" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required authorizations, due to Missing Authorization Check." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "5.4", + "vectorString": "CVSS:/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Missing Authorization Check" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2912747", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2912747" } ] } diff --git a/2020/6xxx/CVE-2020-6257.json b/2020/6xxx/CVE-2020-6257.json index 93bb55aab93..2a51de75202 100644 --- a/2020/6xxx/CVE-2020-6257.json +++ b/2020/6xxx/CVE-2020-6257.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6257", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business Objects Business Intelligence Platform (CMC and BI launchpad)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "4.2" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "5.4", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2907781", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2907781" } ] } diff --git a/2020/6xxx/CVE-2020-6258.json b/2020/6xxx/CVE-2020-6258.json index 4104b347f63..72fa29c9b5d 100644 --- a/2020/6xxx/CVE-2020-6258.json +++ b/2020/6xxx/CVE-2020-6258.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6258", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Identity Management", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "8.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to Missing Authorization Check." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "4.3", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Missing Authorization Check" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2915429", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2915429" } ] } diff --git a/2020/6xxx/CVE-2020-6259.json b/2020/6xxx/CVE-2020-6259.json index 11809e0c371..a25d84fbd22 100644 --- a/2020/6xxx/CVE-2020-6259.json +++ b/2020/6xxx/CVE-2020-6259.json @@ -4,14 +4,75 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6259", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Adaptive Server Enterprise", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "15.7" + }, + { + "version_name": "<", + "version_value": "16.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "6.5", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Missing Authorization Check" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2920548", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2920548" } ] } diff --git a/2020/6xxx/CVE-2020-6262.json b/2020/6xxx/CVE-2020-6262.json index 844bf3f1951..bdeada04c73 100644 --- a/2020/6xxx/CVE-2020-6262.json +++ b/2020/6xxx/CVE-2020-6262.json @@ -4,14 +4,91 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-6262", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Application Server ABAP (ST-PI)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "2008_1_46C" + }, + { + "version_name": "<", + "version_value": "2008_1_620" + }, + { + "version_name": "<", + "version_value": "2008_1_640" + }, + { + "version_name": "<", + "version_value": "2008_1_700" + }, + { + "version_name": "<", + "version_value": "2008_1_710" + }, + { + "version_name": "<", + "version_value": "740" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "9.9", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Code Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/2835979", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/2835979" } ] }