CVE-2017-14516

SAP Business Objects Financial Consolidation is affected by a Cross-Site Scripting (XSS) vulnerability prior to 2017-06-13 (SAP Security Note 2422292). The issue is documented across multiple sources (NVD/CNVD/CVE records) with common description: XSS in the Financial Consolidation component befo...

CVE-2017-14516

Cross-Site Scripting XSS exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292...

SAP Note Assistant Insecure handling of SAP Notes signature vulnerability

Advisory ID Internal CORE-2017-0011 1. Advisory Information Title: SAP Note Assistant Insecure handling of SAP Notes signature vulnerability Advisory ID: CORE-2017-0011 Advisory...

World's Biggest Botnet Just Sent 12.5 Million Emails With Scarab Ransomware

A massive malicious email campaign that stems from the world's largest spam botnet Necurs is spreading a new strain of ransomware at the rate of over 2 million emails per hour and hitting computers across the globe. The popular malspam botnet Necrus which has previously found distributing Dridex...

Gratipay: Saying goodbye to HackerOne and Gratipay.

Thank you, HackerOne I would like to make this the final report to Gratipay and thank everyone that was involved in this amazing journey. Gratipay is shutting down at the end of the year https://gratipay.news/the-end-cbfba8f50981 and to finish on a happy note we closed all of our reports as...

Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2017-2998)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2998 advisory. 1:1.8.0.151-1.b12 - repack policies adapted to new counts and paths - note that also c-j-c is needed to make this apply in next update - Resolves:...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6355. Reason: This candidate is a duplicate of CVE-2014-6355. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-6355 instead of this candidate. All references and descriptions in this...

CVE-2017-15296

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

CVE-2017-15295

Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064...

CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

CVE-2017-15296

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

CVE-2017-15294

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

CVE-2017-15293

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064...

Authentication flaw

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

Design/Logic Flaw

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

CVE-2017-15294

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

Cross site request forgery (csrf)

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

CVE-2017-15293

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064...

CVE-2017-15297

CVE-2017-15297 concerns SAP Hostcontrol where the SOAP SAPControl endpoint does not require authentication, enabling unauthenticated access. The vulnerability is documented in SAP Security Note 2442993. According to the NVD entry, the affected component is the SAP Hostcontrol SOAP interface, with...