CVE-2019-0403

The CVE-2019-0403 case concerns SAP Enable Now (before version 1911). The available connected sources confirm a vulnerability in CSV handling where an attacker can input commands into CSV files, and those commands are executed when the file is opened, resulting in CSV Command Injection. The root ...

PT-2019-11239

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions prior to 1911 Description: The issue allows information leakage about the existence of a particular user, which can be utilized to create a list of users. This leads to a user enumeration issue and information...

PT-2019-11237

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions prior to 1911 Description: The issue allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection. Recommendations: For versions prior to 1911, update to...

PT-2019-11238

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions prior to 1911 Description: The issue leads to information disclosure due to the leakage of network configuration details in server error messages. Recommendations: For versions prior to 1911, update to version 1911 or...

CVE-2019-0403: Improper Neutralization of Formula Elements in a CSV File

SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection...

CVE-2019-0405: Exposure of Sensitive Information to an Unauthorized Actor

SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure...

CVE-2019-0404: Generation of Error Message Containing Sensitive Information

SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure...

SAP Enable Now Multiple Unspecified Security Vulnerabilities

Description SAP Enable Now is prone to multiple unspecified security vulnerabilities. Limited information is currently available regarding these issues. We will update this BID as more information emerges. SAP Enable Now version 1911 is vulnerable. Technologies Affected SAP Enable Now 1911...

SAP Enable Now Cross-Site Scripting Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is mainly used for online learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now. The vulnerability stems from a lack of proper...

CVE-2019-0385

SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0385

SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0385

CVE-2019-0385 affects SAP Enable Now prior to version 1908, where the product does not sufficiently encode user-controlled inputs, enabling a Cross-Site Scripting (XSS) vulnerability. The issue is a client-side input handling flaw that could allow execution of arbitrary script in the browser cont...

CVE-2019-0385

SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2019-0385: Improper Neutralization of Input During Web Page Generation

SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

SAP Enable Now CVE-2019-0385 Unspecified Cross Site Scripting Vulnerability

Description SAP Enable Now is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Remote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...

PT-2019-4461

Name of the Vulnerable Software and Affected Versions SAP Enable Now versions prior to 1908 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability. This can be exploited by a remote attacker to conduct XSS attacks...

SAP Enable Now Input Validation Error Vulnerability (CNVD-2020-04335)

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. An input validation error vulnerability exists in SAP Enable Now. The vulnerability originates from a network system...

CVE-2019-11495

In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remot...

CVE-2019-0341

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application...