[월:] 2022년 09월

CVE-2022-35294

Posted on by admin

CVE-2022-35294

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.

Source: CVE-2022-35294

CVE-2022-35295

Posted on by admin

CVE-2022-35295

Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) – versions 420, 430, exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.

Source: CVE-2022-35295

CVE-2022-35298

Posted on by admin

CVE-2022-35298

SAP NetWeaver Enterprise Portal (KMC) – version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser session.

Source: CVE-2022-35298

CVE-2022-3027

Posted on by admin

CVE-2022-3027

The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.

Source: CVE-2022-3027