Sap Disclosure Management (Sap Se) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2020-07-14. Vendor: Sap Se.
CVEs of Sap Disclosure Management
- CVE-2020-6291 - CVSS 8.8 (high), 2020-07-14: SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once,…
- CVE-2020-6290 - CVSS 6.3 (medium), 2020-07-14: SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.
- CVE-2020-6289 - CVSS 8.8 (high), 2020-07-14: SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing…
- CVE-2020-6292 - CVSS 8.8 (high), 2020-07-14: Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.
- CVE-2020-6267 - CVSS 6.3 (medium), 2020-07-14: Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.
- CVE-2020-6209 - CVSS 7.5 (high), 2020-03-10: SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts…
- CVE-2020-6303 - CVSS 5.4 (medium), 2020-01-14: SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.
- CVE-2019-0258 - CVSS 8.8 (high), 2019-02-15: SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- CVE-2019-0254 - CVSS 5.4 (medium), 2019-02-15: SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)…
- CVE-2018-2404 - CVSS 9.8 (critical), 2018-04-10: SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.
- CVE-2018-2403 - CVSS 6.5 (medium), 2018-04-10: Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an…
- CVE-2018-2413 - CVSS 8.8 (high), 2018-04-10: SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- CVE-2018-2412 - CVSS 8.8 (high), 2018-04-10: SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
