PT-2020-19009

Name of the Vulnerable Software and Affected Versions SAP Fiori Launchpad versions 753 through 754 Description The issue arises from insufficient encoding of user-controlled inputs, allowing an attacker to inject meta tags into the launchpad HTML. This is achieved by exploiting the vulnerable...

PT-2020-18987

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.40 SAP S/4HANA versions 7.50 through 7.54 Description The issue arises from insufficient encoding of user-controlled inputs, leading to a Reflected Cross-Site Scripting XSS vulnerability. This occurs under certain...

CentOS 6 : spice-gtk (RHSA-2020:0471)

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0471 advisory. - Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the...

CVE-2020-6305

PI Rest Adapter of SAP Process Integration update provided in SAPXIAF 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

PT-2019-4461

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions prior to 1908 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability. This can be exploited by a remote attacker to conduct XSS attacks...

PT-2019-4308

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface versions prior to 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, allowing an attacker to store malicious scripts in th...

PT-2019-4341

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management versions prior to 3.73, 7.31, 7.32 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. This can be exploited by a remote...

PT-2019-4393

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50 Description The issue is related to insufficient encoding of user-controlled inputs, allowing an attacker to execute malicious scripts in the URL, resulting in a...

spice-gtk security and bug fix update

libgovirt 0.3.4-2 - Parse XML nodes automatically Related: rhbz1427467 - Set detailed error message for async call Related: rhbz1427467 spice-gtk 0.35-4 - Fix bad channel-reset on usbredir Resolves: rhbz1625550 0.35-3 - Fix insufficient encoding checks for LZ Resolves: rhbz1598652 spice-vdagent...

Denial Of Service (DoS)

spice-client is vulnerable to denial of service DoS. The vulnerability exists as there is insufficient encoding checks for LZ can cause different integer/buffer overflows...

PT-2019-4589

Name of the Vulnerable Software and Affected Versions SAP Information Steward version 4.2 Description The issue exists due to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. This could allow a remote attacker to perform cross-site scripting attacks...

PT-2019-4590

Name of the Vulnerable Software and Affected Versions SAPUI5 versions prior to 1.38.39 SAPUI5 versions prior to 1.44.39 SAPUI5 versions prior to 1.52.25 SAPUI5 versions prior to 1.60.6 SAPUI5 versions prior to 1.63.0 OpenUI5 versions prior to 1.38.39 OpenUI5 versions prior to 1.44.39 OpenUI5...

PT-2019-11227

Name of the Vulnerable Software and Affected Versions: SAP R/3 Enterprise Application Automotive Dealer Portal versions 600 through 617 Description: The issue arises from insufficient encoding of user-controlled inputs, allowing an attacker to send unwanted scripts to the victim's browser and...

PT-2019-11223

Name of the Vulnerable Software and Affected Versions: SAP E-Commerce Business-to-Consumer application versions prior to 7.30, 7.31, 7.32, 7.33, 7.54 are not explicitly mentioned, however, the fixed versions are mentioned, so we can infer the affected versions as: SAP E-Commerce...

PT-2019-5601

Name of the Vulnerable Software and Affected Versions SAP WebIntelligence BILaunchPad versions 4.10, 4.20 Description The issue is related to insufficient encoding of user-controlled inputs in generated HTML reports, resulting in a Cross-Site Scripting XSS issue. This can be exploited by a remote...

PT-2019-11209

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions prior to 7.31, 7.46, 7.47, 7.48, 8.0, 8.01 Description: The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. Recommendations: For SAP CRM WebClie...

PT-2019-11208

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions prior to 7.31, 7.46, 7.47, 7.48, 8.0, 8.01 SAP CRM WebClient UI versions prior to SAPSCORE 1.12 SAP CRM WebClient UI versions prior to S4FND 1.02 SAP CRM WebClient UI versions prior to WEBCUIF 7.31, 7.46, 7.47,...

PT-2019-11204

Name of the Vulnerable Software and Affected Versions: SAP Commerce versions prior to 6.7 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting XSS issue. Recommendations: For versions prior to 6.7, update to version 6.7 or later to...

PT-2018-3417

Name of the Vulnerable Software and Affected Versions: SAP Marketing versions 1.20 through 1.40 SAP Marketing component SAPSCORE versions 1.13 through 1.14 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This...

CVE-2018-6076

CVE-2018-6076 affects Google Chrome (Blink) where URL fragment identifiers were not encoded correctly, enabling a remote attacker to trigger a DOM-based XSS via a crafted HTML page. Concrete details in connected records place the vulnerable component in Blink/Chrome prior to version 65.0.3325.146...