CVE-2019-0404

CVE-2019-0404 affects SAP Enable Now prior to version 1911. The vulnerability stems from server error messages that reveal network configuration, causing information disclosure. The connected sources corroborate the affected product/version and the disclosure impact; they do not provide explicit ...

CVE-2019-0403

The CVE-2019-0403 case concerns SAP Enable Now (before version 1911). The available connected sources confirm a vulnerability in CSV handling where an attacker can input commands into CSV files, and those commands are executed when the file is opened, resulting in CSV Command Injection. The root ...

CVE-2020-6197

SAP Enable Now is affected prior to version 1908, where sessions are not invalidated in a timely manner. This Insufficient Session Expiration could allow local attackers to still download portables. Affected product is SAP Enable Now; root cause is inadequate session token invalidation. Exposure ...

CVE-2020-6178

SAP Enable Now (before version 1911) is affected by CVE-2020-6178, where the Session ID cookie value is sent in the URL. This creates a risk of information disclosure if the URL is captured from browser history or logs. The description is consistently stated across multiple sources (NVD entry and...

CVE-2019-0405

CVE-2019-0405 affects SAP Enable Now prior to version 1911, where information leakage exposes the existence of a specific user, enabling user enumeration and information disclosure. The connected sources consistently describe this as a user existence disclosure vulnerability in SAP Enable Now; no...

CVE-2019-0340

CVE-2019-0340 affects SAP Enable Now; before version 1902 its XML parser is not hardened, enabling Missing XML Validation and local XXE disclosure via file upload at multiple locations. The NVD entry lists CVSSv3 base 5.4 (Medium) with network attack, low privileges, no user interaction. Connecte...

CVE-2019-0385

CVE-2019-0385 affects SAP Enable Now prior to version 1908, where the product does not sufficiently encode user-controlled inputs, enabling a Cross-Site Scripting (XSS) vulnerability. The issue is a client-side input handling flaw that could allow execution of arbitrary script in the browser cont...

CVE-2024-34692

CVE-2024-34692 concerns SAP Enable Now. The connected documents confirm an authentication requirement and a flaw where missing verification of file type or content allows an attacker to upload arbitrary files, including executables, which may be downloaded and executed by users, potentially hosti...