‼ CVE-2022-23790 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).This issue affects Customer Relation Manager: before 2022.03.13.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27501 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26460 ‼
📖 Read
via "National Vulnerability Database".
Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27500 ‼
📖 Read
via "National Vulnerability Database".
An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable.📖 Read
via "National Vulnerability Database".
❤1
‼ CVE-2022-47595 ‼
📖 Read
via "National Vulnerability Database".
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <= 9.0.15 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47163 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47443 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23791 ‼
📖 Read
via "National Vulnerability Database".
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).This issue affects Customer Relation Manager: before 2022.03.13.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23857 ‼
📖 Read
via "National Vulnerability Database".
Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailable.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27894 ‼
📖 Read
via "National Vulnerability Database".
SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25615 ‼
📖 Read
via "National Vulnerability Database".
Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the current session of the user by injecting the malicious database queries over the network and gain access to the unintended data. This may lead to a high impact on the confidentiality and no impact on the availability and integrity of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-24526 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26457 ‼
📖 Read
via "National Vulnerability Database".
SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47143 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG plugin <= 3.3.9 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-47141 ‼
📖 Read
via "National Vulnerability Database".
Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Dynamic Keywords Injector plugin <= 2.3.15 versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25618 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-administrative user can craft a request with certain parameters which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27498 ‼
📖 Read
via "National Vulnerability Database".
SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a crafted request which results in a memory corruption error. This error can be used to reveal but not modify any technical information about the server. It can also make a particular service temporarily unavailable📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25616 ‼
📖 Read
via "National Vulnerability Database".
In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. Successful attack could highly impact the confidentiality, Integrity, and Availability of the system.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27270 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27268 ‼
📖 Read
via "National Vulnerability Database".
SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges.📖 Read
via "National Vulnerability Database".
🕴 Orgs Have a Long Way to Go in Securing Remote Workforce 🕴
📖 Read
via "Dark Reading".
Organizations recognize they are responsible for protecting remote workers from cyber threats, but they have a long way to go in deploying the necessary security technologies.📖 Read
via "Dark Reading".
Dark Reading
Orgs Have a Long Way to Go in Securing Remote Workforce
Organizations recognize that they are responsible for protecting remote workers from cyber threats, but they have a long way to go in deploying the necessary security technologies.