mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-07 19:17:10 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
31665147c8
commit
16428f3650
@ -1,17 +1,66 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-12823",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ID": "CVE-2020-12823",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted certificate data to get_cert_name in gnutls.c."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://gitlab.com/openconnect/openconnect/-/merge_requests/108",
|
||||
"refsource": "MISC",
|
||||
"name": "https://gitlab.com/openconnect/openconnect/-/merge_requests/108"
|
||||
},
|
||||
{
|
||||
"url": "https://bugs.gentoo.org/721570",
|
||||
"refsource": "MISC",
|
||||
"name": "https://bugs.gentoo.org/721570"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2020/12xxx/CVE-2020-12824.json
Normal file
18
2020/12xxx/CVE-2020-12824.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-12824",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
62
2020/12xxx/CVE-2020-12825.json
Normal file
62
2020/12xxx/CVE-2020-12825.json
Normal file
@ -0,0 +1,62 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2020-12825",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://gitlab.gnome.org/GNOME/libcroco/-/issues/8",
|
||||
"refsource": "MISC",
|
||||
"name": "https://gitlab.gnome.org/GNOME/libcroco/-/issues/8"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -4,7 +4,8 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-1746",
|
||||
"ASSIGNER": "msiddiqu@redhat.com"
|
||||
"ASSIGNER": "secalert@redhat.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
|
||||
@ -4,14 +4,110 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6240",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "750"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "752"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "753"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "754"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "700"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "710"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "730"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "731"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "804"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "5.3",
|
||||
"vectorString": "CVSS:/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Denial of Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2856923",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2856923"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6241",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "8.8",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "SQL Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2916927",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2916927"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,79 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6242",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Business Objects Business Intelligence Platform (Live Data Connect)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "1.0"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2.0"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2.x"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.x, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing Authentication Check."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "9.8",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Missing Authentication Check"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2885244",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2885244"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,75 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6243",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise (XP Server on Windows Platform)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "15.7"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "8.0",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2915585",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2915585"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6244",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Business Client",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "7.0",
|
||||
"vectorString": "CVSS:/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-427"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2911801",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2911801"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6245",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Business Objects Business Intelligence Platform",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "4.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "6.5",
|
||||
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-99"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2828558",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2828558"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6247",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Business Objects Business Intelligence Platform",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "4.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "5.9",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Denial of Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2828558",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2828558"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6248",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise (Backup Server)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "9.1",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2917275",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2917275"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,101 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6249",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Master Data Governance (S4CORE)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "101"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP Master Data Governance (S4FND)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "102"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "103"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "104"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP Master Data Governance (SAP_BS_FND)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "748"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "7.7",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "SQL Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2908560",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2908560"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6250",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to read system administrator password leading to Information Disclosure. This could help the attacker to read/write any data and even stop the server like an administrator."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "6.8",
|
||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2917022",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2917022"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6251",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP BusinessObjects Business Intelligence Platform",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "4.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "4.3",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2828558",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2828558"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6252",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise (Cockpit)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confidential information, leading to Information Disclosure. It can be used to get user account credentials, tamper with system data and impact system availability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "9.0",
|
||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2917090",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2917090"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,75 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6253",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise (Web Services)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "15.7"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries to elevate their privileges, modify database objects, or execute commands they are not otherwise authorized to execute, leading to SQL Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "7.2",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "SQL Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2917273",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2917273"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,75 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6254",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Enterprise Threat Detection",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "1.0"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "6.1",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cross Site Scripting"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2913293",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2913293"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,107 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6256",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Master Data Governance",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "748"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "749"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "750"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "751"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "752"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "800"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "801"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "802"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "803"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "804"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required authorizations, due to Missing Authorization Check."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "5.4",
|
||||
"vectorString": "CVSS:/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Missing Authorization Check"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2912747",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2912747"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6257",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Business Objects Business Intelligence Platform (CMC and BI launchpad)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "4.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "5.4",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cross Site Scripting"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2907781",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2907781"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,71 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6258",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Identity Management",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "8.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to Missing Authorization Check."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "4.3",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Missing Authorization Check"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2915429",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2915429"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,75 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6259",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Adaptive Server Enterprise",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "15.7"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "16.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "6.5",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Missing Authorization Check"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2920548",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2920548"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -4,14 +4,91 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-6262",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Application Server ABAP (ST-PI)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2008_1_46C"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2008_1_620"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2008_1_640"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2008_1_700"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "2008_1_710"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "740"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"baseScore": "9.9",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
|
||||
},
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2835979",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2835979"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user