diff --git a/2021/37xxx/CVE-2021-37726.json b/2021/37xxx/CVE-2021-37726.json index a00b6858e71..4a9def00356 100644 --- a/2021/37xxx/CVE-2021-37726.json +++ b/2021/37xxx/CVE-2021-37726.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-37726", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-alert@hpe.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "HPE Aruba Instant (IAP)", + "version": { + "version_data": [ + { + "version_value": "Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "remote buffer overflow" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt", + "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability." } ] } diff --git a/2021/37xxx/CVE-2021-37727.json b/2021/37xxx/CVE-2021-37727.json index 9aae3c9a94c..805247bfbca 100644 --- a/2021/37xxx/CVE-2021-37727.json +++ b/2021/37xxx/CVE-2021-37727.json @@ -4,14 +4,70 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-37727", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-alert@hpe.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "HPE Aruba Instant (IAP)", + "version": { + "version_data": [ + { + "version_value": "Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below" + }, + { + "version_value": "Aruba Instant 6.5.x.x: 6.5.4.20 and below" + }, + { + "version_value": "Aruba Instant 8.5.x.x: 8.5.0.12 and below" + }, + { + "version_value": "Aruba Instant 8.6.x.x: 8.6.0.11 and below" + }, + { + "version_value": "Aruba Instant 8.7.x.x: 8.7.1.3 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "remote arbitrary command execution" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt", + "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability." } ] } diff --git a/2021/37xxx/CVE-2021-37730.json b/2021/37xxx/CVE-2021-37730.json index 18a5eb10b4b..eac29b26fcc 100644 --- a/2021/37xxx/CVE-2021-37730.json +++ b/2021/37xxx/CVE-2021-37730.json @@ -4,14 +4,70 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-37730", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-alert@hpe.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "HPE Aruba Instant (IAP)", + "version": { + "version_data": [ + { + "version_value": "Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below" + }, + { + "version_value": "Aruba Instant 6.5.x.x: 6.5.4.20 and below" + }, + { + "version_value": "Aruba Instant 8.5.x.x: 8.5.0.12 and below" + }, + { + "version_value": "Aruba Instant 8.6.x.x: 8.6.0.11 and below" + }, + { + "version_value": "Aruba Instant 8.7.x.x: 8.7.1.3 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "remote arbitrary command execution" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt", + "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-017.txt" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability." } ] } diff --git a/2021/38xxx/CVE-2021-38178.json b/2021/38xxx/CVE-2021-38178.json index 9deafe51496..155e98afdb4 100644 --- a/2021/38xxx/CVE-2021-38178.json +++ b/2021/38xxx/CVE-2021-38178.json @@ -4,14 +4,123 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-38178", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver AS ABAP and ABAP Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "700" + }, + { + "version_name": "<", + "version_value": "701" + }, + { + "version_name": "<", + "version_value": "702" + }, + { + "version_name": "<", + "version_value": "710" + }, + { + "version_name": "<", + "version_value": "730" + }, + { + "version_name": "<", + "version_value": "731" + }, + { + "version_name": "<", + "version_value": "740" + }, + { + "version_name": "<", + "version_value": "750" + }, + { + "version_name": "<", + "version_value": "751" + }, + { + "version_name": "<", + "version_value": "752" + }, + { + "version_name": "<", + "version_value": "753" + }, + { + "version_name": "<", + "version_value": "754" + }, + { + "version_name": "<", + "version_value": "755" + }, + { + "version_name": "<", + "version_value": "756" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Authorization" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3097887", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3097887" } ] } diff --git a/2021/38xxx/CVE-2021-38179.json b/2021/38xxx/CVE-2021-38179.json index 542cf4ae367..ddd03b3fe7d 100644 --- a/2021/38xxx/CVE-2021-38179.json +++ b/2021/38xxx/CVE-2021-38179.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-38179", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business One", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "10.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information Disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://launchpad.support.sap.com/#/notes/3074819", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3074819" + }, + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" } ] } diff --git a/2021/38xxx/CVE-2021-38180.json b/2021/38xxx/CVE-2021-38180.json index 7152595534c..cfddcd44b1f 100644 --- a/2021/38xxx/CVE-2021-38180.json +++ b/2021/38xxx/CVE-2021-38180.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-38180", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP Business One", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "10.0" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while opening the file and the security settings of Excel allow for command execution." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-1236" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3079427", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3079427" } ] } diff --git a/2021/38xxx/CVE-2021-38181.json b/2021/38xxx/CVE-2021-38181.json index b4ac3a09b8b..0868ee80976 100644 --- a/2021/38xxx/CVE-2021-38181.json +++ b/2021/38xxx/CVE-2021-38181.json @@ -4,14 +4,119 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-38181", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver AS ABAP and ABAP Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "700" + }, + { + "version_name": "<", + "version_value": "701" + }, + { + "version_name": "<", + "version_value": "702" + }, + { + "version_name": "<", + "version_value": "730" + }, + { + "version_name": "<", + "version_value": "731" + }, + { + "version_name": "<", + "version_value": "740" + }, + { + "version_name": "<", + "version_value": "750" + }, + { + "version_name": "<", + "version_value": "751" + }, + { + "version_name": "<", + "version_value": "752" + }, + { + "version_name": "<", + "version_value": "753" + }, + { + "version_name": "<", + "version_value": "754" + }, + { + "version_name": "<", + "version_value": "755" + }, + { + "version_name": "<", + "version_value": "756" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Denial of Service" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://launchpad.support.sap.com/#/notes/3080710", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3080710" + }, + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" } ] } diff --git a/2021/38xxx/CVE-2021-38183.json b/2021/38xxx/CVE-2021-38183.json index 6d9b0920b62..211edc2e555 100644 --- a/2021/38xxx/CVE-2021-38183.json +++ b/2021/38xxx/CVE-2021-38183.json @@ -4,14 +4,83 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-38183", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "700" + }, + { + "version_name": "<", + "version_value": "701" + }, + { + "version_name": "<", + "version_value": "702" + }, + { + "version_name": "<", + "version_value": "730" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3084937", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3084937" } ] } diff --git a/2021/40xxx/CVE-2021-40495.json b/2021/40xxx/CVE-2021-40495.json index 6f1216c2d11..f97422cc820 100644 --- a/2021/40xxx/CVE-2021-40495.json +++ b/2021/40xxx/CVE-2021-40495.json @@ -4,14 +4,95 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-40495", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver AS ABAP and ABAP Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "740" + }, + { + "version_name": "<", + "version_value": "750" + }, + { + "version_name": "<", + "version_value": "751" + }, + { + "version_name": "<", + "version_value": "752" + }, + { + "version_name": "<", + "version_value": "753" + }, + { + "version_name": "<", + "version_value": "754" + }, + { + "version_name": "<", + "version_value": "755" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application Server ABAP and ABAP Platform." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Denial of Service" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3099011", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3099011" } ] } diff --git a/2021/40xxx/CVE-2021-40496.json b/2021/40xxx/CVE-2021-40496.json index a84a712810c..bc90f8c0c07 100644 --- a/2021/40xxx/CVE-2021-40496.json +++ b/2021/40xxx/CVE-2021-40496.json @@ -4,14 +4,123 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-40496", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver AS ABAP and ABAP Platform", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "700" + }, + { + "version_name": "<", + "version_value": "701" + }, + { + "version_name": "<", + "version_value": "702" + }, + { + "version_name": "<", + "version_value": "730" + }, + { + "version_name": "<", + "version_value": "731" + }, + { + "version_name": "<", + "version_value": "740" + }, + { + "version_name": "<", + "version_value": "750" + }, + { + "version_name": "<", + "version_value": "751" + }, + { + "version_name": "<", + "version_value": "752" + }, + { + "version_name": "<", + "version_value": "753" + }, + { + "version_name": "<", + "version_value": "754" + }, + { + "version_name": "<", + "version_value": "755" + }, + { + "version_name": "<", + "version_value": "756" + }, + { + "version_name": "<", + "version_value": "785" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-284" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3087254", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3087254" } ] } diff --git a/2021/40xxx/CVE-2021-40497.json b/2021/40xxx/CVE-2021-40497.json index 15a7df09535..2e27a9876fd 100644 --- a/2021/40xxx/CVE-2021-40497.json +++ b/2021/40xxx/CVE-2021-40497.json @@ -4,14 +4,75 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-40497", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP BusinessObjects Analysis, (edition for OLAP)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "420" + }, + { + "version_name": "<", + "version_value": "430" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation could lead to exposure of some system specific data like its version." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information Disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3098917", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3098917" } ] } diff --git a/2021/40xxx/CVE-2021-40498.json b/2021/40xxx/CVE-2021-40498.json index b5ca493a8d1..87496207c21 100644 --- a/2021/40xxx/CVE-2021-40498.json +++ b/2021/40xxx/CVE-2021-40498.json @@ -4,14 +4,71 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-40498", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP SuccessFactors Mobile Application (for Android devices)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "< 2108" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is related to Android implementation methods that are widely used across Android mobile applications, and such methods are embedded into the SAP SuccessFactors mobile application. These Android methods begin executing once the user accesses their profile on the mobile application. While executing, it can also pick up the activities from other Android applications that are running in the background of the users device and are using the same types of methods in the application. Such vulnerability can also lead to phishing attacks that can be used for staging other types of attacks." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Denial of Service" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3077635", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3077635" } ] } diff --git a/2021/40xxx/CVE-2021-40499.json b/2021/40xxx/CVE-2021-40499.json index a2f8ef4e592..18e5a0830d5 100644 --- a/2021/40xxx/CVE-2021-40499.json +++ b/2021/40xxx/CVE-2021-40499.json @@ -4,14 +4,79 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-40499", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP NetWeaver Application Server for ABAP (SAP Cloud Print Manager and SAPSprint)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "7.70" + }, + { + "version_name": "<", + "version_value": "7.70 PI" + }, + { + "version_name": "<", + "version_value": "7.70BYD" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Code Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3100882", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3100882" } ] } diff --git a/2021/40xxx/CVE-2021-40500.json b/2021/40xxx/CVE-2021-40500.json index d89f348013c..4382971d73b 100644 --- a/2021/40xxx/CVE-2021-40500.json +++ b/2021/40xxx/CVE-2021-40500.json @@ -4,14 +4,75 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-40500", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@sap.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SAP SE", + "product": { + "product_data": [ + { + "product_name": "SAP BusinessObjects Business Intelligence Platform (Crystal Reports)", + "version": { + "version_data": [ + { + "version_name": "<", + "version_value": "420" + }, + { + "version_name": "<", + "version_value": "430" + } + ] + } + } + ] + } + } + ] + } }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the attacker to retrieve arbitrary files from the server." + } + ] + }, + "impact": { + "cvss": { + "baseScore": "null", + "vectorString": "null", + "version": "3.0" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-611" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983", + "refsource": "MISC", + "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=587169983" + }, + { + "url": "https://launchpad.support.sap.com/#/notes/3074693", + "refsource": "MISC", + "name": "https://launchpad.support.sap.com/#/notes/3074693" } ] } diff --git a/2021/42xxx/CVE-2021-42009.json b/2021/42xxx/CVE-2021-42009.json index 57e49579af7..da36bde9a6b 100644 --- a/2021/42xxx/CVE-2021-42009.json +++ b/2021/42xxx/CVE-2021-42009.json @@ -94,6 +94,11 @@ "refsource": "MISC", "url": "https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3E", "name": "https://lists.apache.org/thread.html/rf0481b9e38ece1ece458d3ce7b2d671df819e3555597f31fc34f084e%40%3Ccommits.trafficcontrol.apache.org%3E" + }, + { + "refsource": "MLIST", + "name": "[oss-security] 20211012 CVE-2021-42009: Apache Traffic Control Arbitrary Email Content Insertion in /deliveryservices/request", + "url": "http://www.openwall.com/lists/oss-security/2021/10/12/1" } ] },