Input validation

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files...

CVE-2019-0340

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files...

CVE-2019-0340

CVE-2019-0340 affects SAP Enable Now; before version 1902 its XML parser is not hardened, enabling Missing XML Validation and local XXE disclosure via file upload at multiple locations. The NVD entry lists CVSSv3 base 5.4 (Medium) with network attack, low privileges, no user interaction. Connecte...

CVE-2019-0341

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...

CVE-2019-0341

The CVE-2019-0341 affects SAP Enable Now, version 1902, where the session cookie is missing the HttpOnly flag. This allows script code executed in the application context to access the session cookie and potentially abuse it to gain access to the application. The connected documents corroborate t...

CVE-2019-0340: Improper Restriction of XML External Entity Reference

The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files...

CVE-2019-0341: Incorrect Permission Assignment for Critical Resource

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...

PT-2019-4452

Name of the Vulnerable Software and Affected Versions SAP Enable Now version 1902 Description The issue is related to the session cookie used by the application, which does not have the HttpOnly flag set. This allows an attacker who runs script code in the context of the application to access the...

PT-2019-4451

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions prior to 1902 Description The issue is related to the XML parser used by SAP Enable Now, which has not been properly hardened, leading to a Missing XML Validation vulnerability. This vulnerability affects file uploads a...