CVE-2020-26828

CVE-2020-26828 affects SAP Disclosure Management 10.1. Authorized users can upload/download certain file types; some formats allow formulas that call external applications or run scripts, enabling payloads to potentially steal or modify spreadsheet data. The connected documents provide the vulner...

CVE-2020-6209

CVE-2020-6209 affects SAP Disclosure Management, version 10.1, where an authenticated user with no roles can bypass authorization checks and access administration accounts due to a Missing Authorization Check. Multiple connected sources (Red Hat, CNVD, NVD/CVE and others) corroborate that the vul...

CVE-2022-41274

CVE-2022-41274 affects SAP Disclosure Management, version 10.1. An authenticated attacker can access misconfigured application endpoints that are exposed over the network, enabling disclosure of sensitive data such as financial reports. The underlying issue appears to be authorization/configurati...

CVE-2020-6291

CVE-2020-6291 affects SAP Disclosure Management 10.1. The session mechanism lacks expiration data, allowing unlimited access after a user authenticates once, resulting in Insufficient Session Expiration. This is documented across multiple sources (NVD, Red Hat, CNVD, CVE lists). No exploits or re...

CVE-2020-6303

CVE-2020-6303 concerns SAP Disclosure Management prior to version 10.1, where the web application does not properly validate certain user inputs, enabling cross-site scripting (XSS) in specific use cases. The vulnerability is tied to insufficient client-side input validation in the web layer, lea...

CVE-2018-2413

CVE-2018-2413 affects SAP Disclosure Management 10.1. The issue is an authorization check omission for authenticated users, leading to privilege escalation. Impact details are described in NVD/SAP CNVD entries, with CVSS metrics cited (high in 3.0 vector, but base CNA score lower). Affected compo...

CVE-2020-6292

CVE-2020-6292 affects SAP Disclosure Management 10.1, where the logout mechanism fails to invalidate a session cookie, resulting in insufficient session expiration. This is documented across multiple sources (SAP disclosures, Red Hat entry, CNVD/CVE coverage). The underlying issue is a cookie inv...

CVE-2019-0254

CVE-2019-0254 affects SAP Disclosure Management (before version 10.1 Stack 1301). The issue is a Cross-Site Scripting (XSS) vulnerability caused by insufficient encoding of user-controlled inputs. The root cause is failure to properly filter/encode user-submitted input, allowing a remote attacker...

CVE-2019-0258

CVE-2019-0258 affects SAP Disclosure Management, version 10.01. The vulnerability arises from insufficient authorization checks for an authenticated user, leading to privilege escalation. The public sources in the connected set describe this issue for the SAP Disclosure Management product but do ...

CVE-2018-2487

CVE-2018-2487 affects SAP Disclosure Management 10.x. A vulnerability in ZIP extraction allows crafted archives to cause files to land in unintended locations, enabling an attacker to overwrite files and potentially compromise data integrity and availability. The issue is described in multiple so...

CVE-2018-2403

SAP Disclosure Management 10.1 contains an access-control weakness that allows an authorized user to point a specific chapter type to a chapter the user should not access, effectively exposing restricted information. The vulnerability is documented across multiple sources (NVD CVE-2018-2403, CNVD...

CVE-2020-6290

SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks where an attacker tricks a user into using a specific session ID. The NVD notes a network-exposed vector with user interaction required, and impact on confidentiality, integrity, and availability is Low. No explici...

CVE-2018-2404

CVE-2018-2404 affects SAP Disclosure Management 10.1. The vulnerability arises because the product fails to validate file formats during upload, enabling an attacker to upload arbitrary files. Exploitation status is not provided in the connected documents. Impact details in the sources indicate p...

CVE-2020-6289

CVE-2020-6289 concerns SAP Disclosure Management 10.1, where CSRF protections are insufficient. The vulnerability allows an attacker to trick a user into visiting a malicious site, potentially enabling malicious actions via the user’s authenticated session. Root cause: insufficient protection aga...

CVE-2020-6267

SAP Disclosure Management 10.1 is affected by CVE-2020-6267, where sensitive cookies are missing the HttpOnly flag. The available documents confirm the issue is tied to HttpOnly not being set on cookies, enabling potential exposure of sensitive cookie data. No detailed exploit steps or CVE-specif...

CVE-2018-2412

CVE-2018-2412 – SAP Disclosure Management 10.1 : The issue is that the product does not perform necessary authorization checks for an authenticated user, enabling escalation of privileges. The primary impact stated in the sources is elevated access within the application, with CVSS metrics indica...