CVE Vulnerability Catalog

Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.

SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causing unbounded memory growth. This results in a low impact on availability, with no impact on confidentiality and integrity.

SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability.

SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low impact on confidentiality, with no impact on integrity and availability of the application.

SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application functions, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access user account information in the application, which could be leveraged to facilitate further attacks. This vulnerability results in low impact on confidentiality, with no impact on integrity and availability.

SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on integrity and availability, with no impact on confidentiality.

SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability, with no impact on confidentiality and integrity.

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity, with no impact on availability.

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.

SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that trigger a buffer overflow in the affected component. This causes a temporary service interruption and automatic restart, resulting in low impact on availability but no impact on confidentiality and integrity.

TP-Link Aginet devices do not properly validate symbolic links on external USB storage. An attacker can place a crafted symlink on supported media, causing the system to resolve it, potentially allowing unauthorized read access to sensitive files.

In Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated user with create-team permission to convert an unrelated public channel by supplying channelName instead of channelId because the edit-room permission is checked only for channelId.

In Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender is not checked, and the client-side UI can create an ephemeral fake message in another user's currently open chat.

In AnythingLLM versions 1.0.0 to 1.15.0, the unauthenticated account-recovery flow has a flaw in recoverAccount() that fails to trim recovery code values before deduplication. An attacker knowing the username and one recovery code can submit the same code twice with different whitespace to satisfy the two-code check and take over an account, including an administrator.

In Mastodon before versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? does not recognize IPv4-compatible IPv6 addresses, allowing an attacker to bypass ALLOWED_PRIVATE_ADDRESSES protection and send HTTP requests to loopback interfaces, potentially accessing private resources. Exploitation requires a system supporting the obsolete IPv4-compatible IPv6 mechanism.

In QEMU, a type mismatch vulnerability exists in vhost inflight migration VMState handling. The destination buffer size is stored as uint64_t but read as int32_t, which on little-endian hosts can lead to out-of-bounds reads and crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel.

PingFederate versions before 13.1 have CSRF weaknesses in the Administrative Console that may allow attackers to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.

npm-check-updates through 23.0.2 contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with --format homepage or --format repo, unfiltered escape sequences are written to the terminal, enabling malicious output manipulation or other terminal-dependent effects.