Sap Disclosure Management
16 CVEs affecting Sap Disclosure Management. Latest disclosed: 2022-12-13. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6292 | High | 8.8 | 2020-07-14 | Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration. |
CVE-2020-6291 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leadi… |
CVE-2020-6289 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malic… |
CVE-2019-0258 | High | 8.8 | 2019-02-15 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2487 | High | 8.3 | 2018-11-13 | SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in specific use cases, file… |
CVE-2020-6209 | High | 7.5 | 2020-03-10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts… |
CVE-2022-41274 | Medium | 6.5 | 2022-12-13 | SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These… |
CVE-2020-26828 | Medium | 6.4 | 2020-12-09 | SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types… |
CVE-2020-6290 | Medium | 6.3 | 2020-07-14 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID. |
CVE-2020-6267 | Medium | 5.4 | 2020-07-14 | Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag. |
CVE-2020-6303 | Medium | 5.4 | 2020-01-14 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. |
CVE-2019-0254 | Medium | 5.4 | 2019-02-15 | SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnera… |
CVE-2018-2413 | Medium | 5.4 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2403 | Medium | 5.4 | 2018-04-10 | Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an au… |
CVE-2018-2404 | Medium | 4.3 | 2018-04-10 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. |
CVE-2018-2412 | Low | 3.8 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |