CVE Vulnerability Catalog

A vulnerability in GitLab EE allows an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE allows an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege assignment. Affects versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 have a vulnerability that, under certain conditions, could allow an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

A vulnerability in GitLab CE/EE allows an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events. Affects versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE contains a flaw in cache key construction that, under certain deployment configurations, allows an authenticated user to poison cached page content served to other users. Affected versions are from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

GitLab CE/EE contains a server-side request forgery (SSRF) vulnerability caused by a time-of-check to time-of-use race condition in URL validation during repository import operations. An authenticated user could, under certain conditions, reach internal network resources.

The Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on data confidentiality, with no impact on integrity and availability.

SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, potentially allowing tracking of user information and defacement of parts of the page.

SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for.

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information. This leads to low impact on confidentiality, with no impact on integrity and availability.

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, potentially leading to session information theft, portal content manipulation, or user redirection.

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. An attacker could execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value, because the value was passed directly to the shell without sanitization.

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organization is specified using an organization ID. An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organization they are not authorized to administer.

SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker controlling the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, leading to client credential exfiltration.

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could lead to full compromise of the remote system.

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the system.

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code. Successful exploitation could allow the attacker to execute arbitrary ABAP code in the system.

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.