143 matches found
CVE-2020-6289
CVE-2020-6289 concerns SAP Disclosure Management 10.1, where CSRF protections are insufficient. The vulnerability allows an attacker to trick a user into visiting a malicious site, potentially enabling malicious actions via the user’s authenticated session. Root cause: insufficient protection aga...
CVE-2020-6289
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site...
CVE-2020-6267
Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag...
CVE-2020-6291
CVE-2020-6291 affects SAP Disclosure Management 10.1. The session mechanism lacks expiration data, allowing unlimited access after a user authenticates once, resulting in Insufficient Session Expiration. This is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists). No exploits or re...
CVE-2020-6292
CVE-2020-6292 affects SAP Disclosure Management 10.1, where the logout mechanism fails to invalidate a session cookie, resulting in insufficient session expiration. This is documented across multiple sources (SAP disclosures, Red Hat entry, CNVD/CVE coverage). The underlying issue is a cookie inv...
CVE-2020-6291
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration...
CVE-2020-6267
SAP Disclosure Management 10.1 is affected by CVE-2020-6267, where sensitive cookies are missing the HttpOnly flag. The available documents confirm the issue is tied to HttpOnly not being set on cookies, enabling potential exposure of sensitive cookie data. No detailed exploit steps or CVE-specif...
CVE-2020-6292
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration...
CVE-2020-6290
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID...
PT-2020-19062 · Sap · Sap Disclosure Management
Name of the Vulnerable Software and Affected Versions: SAP Disclosure Management version 10.1 Description: The issue concerns sensitive cookies missing the HttpOnly flag in SAP Disclosure Management, which can lead to sensitive cookies being accessed without the HttpOnly flag. This affects the...
SAP Disclosure Management Override Vulnerability
SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A security vulnerability exists in SAP Disclosure Management version 10.1, which stems...
CVE-2020-6209
SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check...
CVE-2020-6209
SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check...
Authorization
SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check...
CVE-2020-6209
CVE-2020-6209 affects SAP Disclosure Management, version 10.1, where an authenticated user with no roles can bypass authorization checks and access administration accounts due to a Missing Authorization Check. Multiple connected sources (Red Hat, CNVD, NVD/CVE and others) corroborate that the vul...
CVE-2020-6209
SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check...
The vulnerability of the SAP Disclosure Management software in generating financial reports stems from the lack of protective measures for the website structure, allowing attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the SAP Disclosure Management software for generating financial reports is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
SAP Disclosure Management Cross-Site Scripting Vulnerability (CNVD-2020-03253)
SAP Disclosure Management is an automated financial disclosure management system from SAP. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. A cross-site scripting vulnerability exists in SAP Disclosure Management versions prior ...