CVE-2016-2389
HighSummary
CVE-2016-2389 is a vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4, allowing remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data, posing a significant security threat to the organization.
Recommendation
It is recommended to update to the latest version of SAP to mitigate this vulnerability and to monitor system access for potential attack attempts.
Related vulnerabilities
- CVE-2026-124917Critical
Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124903Critical
A sandbox escape due to a use-after-free exists in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124900Critical
A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.
- CVE-2026-124864Critical
Use-after-free vulnerability in the DOM: Service Workers component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124861Critical
Use-after-free vulnerability in the Audio/Video: cubeb component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124859Critical
Sandbox escape in the Storage: Cache API component of Firefox caused by incorrect boundary conditions. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124853Critical
A sandbox escape vulnerability due to incorrect boundary conditions exists in the Graphics: Text component of Firefox. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-119446Critical
A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.
- CVE-2026-60043Critical
An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
- CVE-2026-13312Critical
The described vulnerability could allow an attacker to compromise a system. Technical details are not provided in the description.
Original NVD description (English source)
Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS