Improper Authorization

Overview Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated...

CVE-2020-6206

SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery...

CVE-2020-6206

SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery...

Cross site request forgery (csrf)

SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery...

CVE-2020-6206

SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery...

SAP Cloud Connector Authorization Issues Vulnerability

SAP Cloud Connector is a connector for connecting to the SAP Cloud Platform from SAP Germany. An authorization issue vulnerability exists in SAP Cloud Connector versions prior to 2.11.3, which stems from the program failing to perform any authentication and can be exploited by an attacker to...

CVE-2019-0247

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

CVE-2019-0247

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

Code injection

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

Authentication flaw

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

CVE-2019-0246

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

CVE-2019-0246

SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity...

CVE-2019-0247

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

Input validation

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2409

The CVE-2018-2409 issue affects SAP Cloud Platform 2.0 components (Connectivity Service and Cloud Connector). The root cause is improper session management, which can allow data from another user to be shown or modified when applications built on SAP Cloud Platform are used. In practice, this lea...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

SAP Cloud Commerce Platform HANA System Session Fixation Vulnerability

The SAP Cloud Commerce Platform HANA system is a real-time data computing platform based on in-memory computing technology. The SAP Cloud Commerce Platform HANA system suffers from several vulnerabilities, one of the critical vulnerabilities is a session fixation vulnerability, which allows an...