DM
Product
Disclosure Management
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 8Medium 7Low 0
Watch
Add Disclosure Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-2404 | 9.8 | Apr 10 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation Affected: 10.1 |
| CVE-2020-6292 | 8.8 | Jul 14 | Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration Affected: 10.1 |
| CVE-2020-6291 | 8.8 | Jul 14 | SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient… Affected: 10.1 |
| CVE-2020-6289 | 8.8 | Jul 14 | SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site Affected: 10.1 |
| CVE-2019-0258 | 8.8 | Feb 15 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges Affected: 10.01 |
| CVE-2018-2413 | 8.8 | Apr 10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges Affected: 10.1 |
| CVE-2018-2412 | 8.8 | Apr 10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges Affected: 10.1 |
| CVE-2018-2487 | 8.3 | Nov 13 | SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in specific use cases, files within this zip… Affected: 10.1 |
| CVE-2020-6209 | 7.5 | Mar 10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no… Affected: 10.1 |
| CVE-2022-41274 | 6.5 | Dec 13 | SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data Affected: 10.1 |
| CVE-2018-2403 | 6.5 | Apr 10 | Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted Affected: 10.1 |
| CVE-2020-26828 | 6.4 | Dec 9 | SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type Affected: 10.1 |
| CVE-2020-6290 | 6.3 | Jul 14 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID Affected: 10.1 |
| CVE-2020-6267 | 5.4 | Jul 14 | Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag Affected: 10.1 |
| CVE-2020-6303 | 5.4 | Jan 14 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting Affected: before 10.1 |
| CVE-2019-0254 | 5.4 | Feb 15 | SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability Affected: before 10.1 |
Showing 16