CVE-2024-34685

The CVE-2024-34685 entry concerns SAP NetWeaver Knowledge Management XMLEditor. Affected component: SAP NetWeaver Knowledge Management XMLEditor (XMLEditor) in SAP NetWeaver. Description: weak encoding of user-controlled input enables execution of malicious scripts, i.e., a Cross-Site Scripting (...

CVE-2024-34685 [CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor

Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application but it has a...

CVE-2024-39593

SAP Landscape Management is affected by an information-disclosure vulnerability where an authenticated user can read confidential data exposed by the REST Provider Definition response. The issue is reported across multiple feeds (NVD, Red Hat, CVE lists) and is described as high impact to confide...

CVE-2024-39593 [CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management

SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities...

CVE-2024-39593 [CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management

SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities...

CVE-2024-39597 [CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce

In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this ca...

CVE-2024-39597

SAP Commerce contains an authorization issue where an attacker can abuse the Forgot Password flow to gain access to a Composable Storefront B2B site with early login/registration enabled, without merchant approval. If the site is not configured as isolated, access may extend to other non-isolated...

CVE-2024-39597 [CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce

In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not configured as isolated site, this ca...

CVE-2024-39592 [CVE-2024-39592] Missing Authorization check in SAP PDCE

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application...

CVE-2024-39592 [CVE-2024-39592] Missing Authorization check in SAP PDCE

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application...

SAP Enable Now 安全漏洞

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. SAP Enable Now suffers from an authorization issue vulnerability that stems from a lack of authorization checking,...

SAP Commerce 授权问题漏洞

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. This product supports sales management, marketing management, order management and operations management. SAP Commerce suffers from an authorization issue vulnerability that originates from a user being able to abuse the...

SAP Enable Now Code Issue Vulnerability

SAP Enable Now is a suite of collaborative content creation, management and sharing platforms from SAP, a German company. The platform is primarily used for online learning and training in SAP and non-SAP systems, among others. SAP Enable Now suffers from a code issue vulnerability that stems fro...

SAP CRM 跨站脚本漏洞

SAP CRM is a customer relationship management system from SAP, Germany. SAP CRM suffers from a cross-site scripting vulnerability that stems from custom CSS support options that do not adequately encode user-controlled input, which can be exploited by an attacker to execute arbitrary web script o...

SAP NetWeaver 跨站脚本漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A cross-site scripting vulnerability exists in SAP NetWeaver Knowledge Management XMLEditor, which stems...

SAP CRM 代码问题漏洞

SAP CRM is a customer relationship management system from SAP in Germany. SAP CRM suffers from an information disclosure vulnerability that stems from the application's inadequate protection of sensitive information, which can be exploited by an authenticated attacker to enumerate accessible HTTP...

SAP Transportation Management Code Issue Vulnerability

SAP Transportation Management is an integrated transportation fleet and logistics management application from SAP, Germany, that helps organizations reduce complexity, increase efficiency and agility to build a more sustainable and risk-resilient supply chain. A code issue vulnerability exists in...

SAP GUI Information Disclosure Vulnerability

SAP GUI is an application from SAP, a German company. graphical user interface for SAP systems. An information disclosure vulnerability exists in SAP GUI for Windows, which arises from the fact that under certain conditions, memory contains passwords used to log on to the SAP system, which could...

SAP NetWeaver Application Server Security Vulnerability

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server that stems from a failure in the protection mechanism, which allows a developer to bypass the configured Malware Scanner API, resulting in a low impact ...

SAP Business Warehouse Cross-Site Scripting Vulnerability

SAP Business Warehouse is a key component for executing business processes from SAP, Germany, that allows users to design, implement, and manage business processes, ensure process compliance, and reduce the need for manual operations through automation. SAP Business Warehouse suffers from a...