CVE Vulnerability Catalog

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information. This leads to low impact on confidentiality, with no impact on integrity and availability.

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, potentially leading to session information theft, portal content manipulation, or user redirection.

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. An attacker could execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value, because the value was passed directly to the shell without sanitization.

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organization is specified using an organization ID. An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organization they are not authorized to administer.

The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker controlling the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server and exfiltrate client credentials. The issue was originally fixed in 0.45.2, reintroduced in 0.53.0 during an HTTP client refactor, and the validation was restored in 0.55.1.

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could lead to full compromise of the remote system.

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the system.

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code. Successful exploitation could allow the attacker to execute arbitrary ABAP code in the system.

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. An attacker could gain unauthorized access to the system by using tokens that should not be accepted.

Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. The update (PUT) and delete (DELETE) handlers for /api/v1/credentials omit the authentication call, unlike other routes. Any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential without authentication. All published versions through 6.5.4 are affected; fixed in 6.5.5 by adding authentication.

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on confidentiality and integrity and no impact on availability.

Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads attacker-controlled input and writes it into the DOM without proper sanitization, causing script execution in the victim's browser. This could allow access or modification of information within the victim's browser scope, impacting confidentiality and integrity, while availability remains unaffected.

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page displaying this content, the injected input is processed during web page generation, resulting in script execution in the victim's browser. This could allow the attacker to access session information, modify rendered page content, and disrupt the victim's use of the application, with low impact on confidentiality, integrity, and availability.

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

SAP Cloud Connector contains an improper authorization check that could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network and could allow obtaining limited information about internal systems.

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. The issue affects the eval function in the file ultralytics/nn/autobackend.py of the AutoBackend Model Loading component. Manipulation of the imgsz/names/kpt_shape arguments results in code injection. The attack must be initiated locally. The project was informed but has not responded.

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. The issue affects the get_obj_from_str function in the file src/utils/model_utils.py of the Config-Driven Model Instantiation component. Manipulation of the Target argument leads to code injection. The attack must be carried out locally. The product uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

A weakness has been identified in ModelTC LightX2V up to 0.5.0. The issue affects the AutoTokenizer.from_pretrained function in the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the Tokenizer component. Manipulation of the auto_map argument causes code injection. The attack is restricted to local execution. The exploit has been made public and could be used for attacks. The project was informed but has not responded.