SAP NetWeaver AS Java and AS ABAP Multiple Vulnerabilities (Apr 2021)

The version of SAP Netweaver Application Server for Java installed on the remote host may be affected by multiple vulnerabilities, including the following: - An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java...

Authorization

SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...

CVE-2021-27605

Summary: CVE-2021-27605 affects SAP HCM Travel Management Fiori Apps V2 (608). The issue is an improper authorization check that permits an authenticated but unauthorized user to read personnel numbers, enabling privilege escalation. The attacker can access limited personnel data (last name, firs...

CVE-2021-27605

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...

CVE-2021-27598

SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet) vulnerability CVE-2021-27598 affects SAP NetWeaver AS JAVA versions 7.31, 7.40, and 7.50. The root cause is a missing authorization check in the Customer Usage Provisioning Servlet, allowing an attacker to read statistical data such as p...

CVE-2021-27598

SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...

CVE-2021-27900

The Proofpoint Insider Threat Management Server formerly ObserveIT Server is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected...

CVE-2021-27900

The Proofpoint Insider Threat Management Server formerly ObserveIT Server is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected...

CVE-2021-27900

The provided CVE pertains to Proofpoint Insider Threat Management Server (formerly ObserveIT Server). Inadequate authorization checks exist on multiple pages of the Web Console, enabling a view‑only user to modify any configuration and delete registered agents. Affected products include all versi...

SAP NetWeaver AS JAVA Missing Authorization Check (3022422)

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

New Relic: Missing Authorization check on View permissions for Alerting Conditions via /internal_api/1/accounts/XXXXXXX/policies/YYYYYYY/conditions?offs endpoint

@archangel reported that an elevation-of-privilege due to a missing authorization check on View permissions for Alerting Conditions could have allowed a user to see alerting policies without having the rights to do so...

CVE-2021-21481

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

Authorization

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

CVE-2021-21481

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

CVE-2021-21481

CVE-2021-21481 affects SAP NetWeaver AS JAVA MigrationService (versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50). The vulnerability arises from a missing authorization check, which could let an unauthorized attacker access configuration objects and potentially grant administrative privileges, en...

Moderate: Red Hat Security Advisory: Red Hat Data Grid 8.1.1 security update

A security update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...

CVE-2020-27220

The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configure...

CVE-2021-1054

NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape in which the software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action, whi...

CVE-2021-1054

NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape in which the software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action, whi...

CVE-2021-1054

CVE-2021-1054 : NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode layer (nvlddmkm.sys) DxgkDdiEscape handler where an actor’s access attempt may bypass/violate authorization checks, potentially causing a Denial of Service. The issue affects Windows NVIDIA GPU Displ...