Improper JWT Signature Validation in SAP Security Services Library

Impact SAP BTP Security Services Integration Library Java cloud-security-services-integration-library allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to...

GHSA-59C9-PXQ8-9C73 Improper JWT Signature Validation in SAP Security Services Library

Impact SAP BTP Security Services Integration Library Java cloud-security-services-integration-library allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to...

SUSE: Security Advisory (SUSE-SU-2023:4736-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@sap-cloud-sdk/core (>=1.48.2-20210910061518.0, <=1.49.1-20210922143656.0), @sap/approuter (>=8.0.0, <=14.4.1) +6 more potentially affected by CVE-2023-49583 via @sap/xssec (>=3.0.3, <=3.5.0)

@sap/xssec NPM version =3.0.3, =1.48.2-20210910061518.0, =8.0.0, =3.2.0, =1.9.38, =6.0.2, =7.4.2, =0.1.92, =0.2.1, =0.4.1 Source cves: CVE-2023-49583 Source advisory: OSV:GHSA-P2VX-QJ66-88Q3...

GHSA-P99H-PFG6-QRFG Duplicate Advisory: Privilege escalation in sap-xssec

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6mjg-37cp-42x5. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Python sap-xssec - versions 4.1.0, allow under certain conditions an...

GHSA-P2VX-QJ66-88Q3 Escalation of privileges in @sap/xssec

SAP BTP Security Services Integration Library Node.js @sap/xssec - versions 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

GHSA-GCGW-Q47M-PRVJ Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59c9-pxq8-9c73. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Java cloud-security-services-integration-library - versions below 2.17....

Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59c9-pxq8-9c73. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Java cloud-security-services-integration-library - versions below 2.17....

Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m8rw-rcpq-2vp2. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Golang github.com/sap/cloud-security-client-go - versions 0.17.0, allow...

Duplicate Advisory: Privilege escalation in sap-xssec

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6mjg-37cp-42x5. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Python sap-xssec - versions 4.1.0, allow under certain conditions an...

Escalation of privileges in @sap/xssec

SAP BTP Security Services Integration Library Node.js @sap/xssec - versions 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

GHSA-92CG-GHQ6-9587 Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m8rw-rcpq-2vp2. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Golang github.com/sap/cloud-security-client-go - versions 0.17.0, allow...

CVE-2023-50424

SAP BTP Security Services Integration Library Golang github.com/sap/cloud-security-client-go - versions 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

Privilege escalation

SAP BTP Security Services Integration Library Golang github.com/sap/cloud-security-client-go - versions 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

CVE-2023-49584

SAP Fiori launchpad - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, SAPUI 758, UI700 200, SAPBASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application...

CVE-2023-50422

SAP BTP Security Services Integration Library Java cloud-security-services-integration-library - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary...

CVE-2023-50423

SAP BTP Security Services Integration Library Python sap-xssec - versions 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

CVE-2023-50423

SAP BTP Security Services Integration Library Python sap-xssec - versions 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application...

CVE-2023-49584

SAP Fiori launchpad - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, SAPUI 758, UI700 200, SAPBASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application...

CVE-2023-49587

SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network...