CVE Vulnerability Catalog

Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could update and delete child entities via OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.

Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This results in a low impact on integrity, while confidentiality and availability are not impacted.

W wyniku podatności na wstrzykiwanie kodu w SAP NetWeaver Application Server Java (Web Dynpro Java), nieautoryzowany atakujący może dostarczyć spreparowane dane, które są interpretowane przez aplikację, co prowadzi do odwołania się do treści kontrolowanej przez atakującego. Jeśli ofiara uzyska dostęp do dotkniętej funkcjonalności, ta treść może zostać wykonana w przeglądarce ofiary.

Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain unauthorized control over file operations. This results in no impact on confidentiality and low impact on integrity and availability.

The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system.

An insecure session management vulnerability in SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to obtain valid session tokens and reuse them to gain unauthorized access to a victim's session. If the application keeps accepting previously issued tokens after authentication, the attacker can assume the victim's authenticated context.

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, results in execution of malicious content within the victim's browser. This could allow the attacker to access and modify information, impacting confidentiality and integrity while availability remains unaffected.

In the libjq library (part of the jq tool), the jv_parse_sized() function has an out-of-bounds read vulnerability. When processing malformed JSON in a non-NUL-terminated buffer, the error formatting function uses %s which reads until a NUL terminator, ignoring the caller-supplied length.

jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive.

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV).

In aandrew-me ytDownloader up to 3.20.2, the child_process.exec function in src/compressor.js (Compressor Feature component) allows command injection. The attack requires local access and the exploit has been publicly disclosed.

A vulnerability was found in ytDownloader up to 3.20.2 in the createTextNode function of the Error Details Panel component, leading to cross-site scripting (XSS). The attack may be performed remotely. The vendor was contacted about this disclosure.

Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controlled input in the _folder parameter allows a specially crafted, double URL-encoded payload to be reflected and executed in the context of an authenticated user's session.

A vulnerability was discovered in code-projects Easy Blog Site 1.0 in post.php where manipulation of the tags argument leads to SQL injection. The attack can be initiated remotely and a public exploit is available.

A vulnerability was identified in CodeAstro Online Job Portal 1.0 in an unknown function of /jobs/job-delete.php within the Delete Job Posting Handler component. Manipulation of the ID argument leads to improper access controls, and the attack can be launched remotely.

Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allows authenticated low-privilege users to escalate privileges by manipulating the original_username cookie. Attackers can set the client-controlled original_username cookie to any value and request a switch to user ID 1 to obtain session tokens or password hashes belonging to administrator accounts.

Pachno 1.0.6 contains a CSRF vulnerability that allows attackers to perform arbitrary actions in an authenticated user's context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload, milestone editing, and administrative functions.

Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.

A vulnerability exists in the command handling of the IEC 61850 communication stack included in the affected product revisions. An attacker with access to IEC 61850 networks could exploit the vulnerability by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation. The System 800xA IEC61850 Connect is not affected.