Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
106 results · page 2 of 3
Mar 11, 2025A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3.CVE-2025-2216 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function UploadCrash of the file /crash/log/SaveCrash.ashx. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check.CVE-2025-25244 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.7
SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.
- Product
- SAP Business Warehouse (Process Chains)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2025A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1.CVE-2025-2115 · Other software · zzskzy · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Warehouse Refinement Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic.CVE-2025-0398 · Other software · longpi1 · reported by VulDBMedium 5.1
A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /resources/..;/inport/updateInport of the component Backend. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused.CVE-2024-52732 · Other software · warehouse_management_system_zeqp · reported by MITRECritical 9.1
Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused.
- Product
- warehouse_management_system_zeqp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 9, 2024Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otheCVE-2024-44113 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
- Product
- SAP Business Warehouse (BEx Analyzer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42586 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42585 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42584 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42583 · Other software · warehouse_inventory_system · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42582 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42581 · Other software · oswapp · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42580 · Other software · oswapp · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42579 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42578 · Other software · oswapp · reported by MITREHigh 8
A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42577 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.CVE-2024-42576 · Other software · siamonhasan · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
- Product
- warehouse_inventory_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2024A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0.CVE-2024-7460 · Other software · OSWAPP · reported by VulDBMedium 6.9
A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change_password.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273553 was assigned to this vulnerability.
- Product
- Warehouse Inventory System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 4, 2024A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0.CVE-2024-7459 · Other software · OSWAPP · reported by VulDBMedium 6.9
A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been classified as problematic. Affected is an unknown function of the file /edit_account.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273552.
- Product
- Warehouse Inventory System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jul 9, 2024SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site ScriptCVE-2024-39595 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause low impact to the confidentiality and integrity of the application.
- Product
- SAP Business Warehouse - Business Planning and Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site ScrCVE-2024-39594 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the application.
- Product
- SAP Business Warehouse - Business Planning and Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06.CVE-2024-37346 · Other software · Absolute Software · reported by SecurityResponse@netmotionsoftware.comMedium 4.9
There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can impair the availability of certain elements of the Secure Access administrative UI by writing invalid data to the warehouse over the network. There is no loss of warehouse integrity or confidentiality, the security scope is unchanged. Loss of availability is high.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabsolute.comabsolute.com
May 29, 2024IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to CVE-2023-42005 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264.
- Product
- Db2 on Cloud Pak for Data
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 1, 2024The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords.CVE-2024-32213 · Other software · lomag · reported by MITREMedium 5.3
The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords. By default, hard-coded passwords of 10 characters with little or no complexity are allowed.
- Product
- warehouse_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
May 1, 2024SQL Injection vulnerability in LOGINT LoMag Inventory Management v1.0.20.120 and before allows an attacker to execute arbitrary code via the ArticleGetGroups, DCVE-2024-32212 · Other software · lomag · reported by MITREHigh 8.1
SQL Injection vulnerability in LOGINT LoMag Inventory Management v1.0.20.120 and before allows an attacker to execute arbitrary code via the ArticleGetGroups, DocAddDocument, ClassClickShop and frmSettings components.
- Product
- warehouse_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
May 1, 2024An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserClass.cs and Settings.cCVE-2024-32211 · Other software · lomag · reported by MITREMedium 5.5
An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserClass.cs and Settings.cs components.
- Product
- warehouse_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
May 1, 2024The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL connections.CVE-2024-32210 · Other software · lomag · reported by MITREMedium 5.3
The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL connections.
- Product
- warehouse_management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Jul 10, 2023The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100CVE-2023-33992 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.5
The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level.
- Product
- SAP Business Warehouse and SAP BW/4HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL.CVE-2023-31131 · Other software · greenplum-db · reported by GitHubHigh 7.4
Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this vulnerability to overwrite data or system files potentially leading to crash or malfunction of the system. Any files which are accessible to the running process are at risk. All users are requested to upgrade to Greenplum Database version 6.23.2 or higher. There are no known workarounds for this vulnerability.
- Product
- gpdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.CVE-2022-38733 · Other software · Netapp · reported by security-alert@netapp.comHigh 8.6
OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.
- Product
- Oncommand Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Jul 26, 2022Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter.CVE-2022-34067 · Other software · Oretnom23 · reported by MITREHigh 7.5
Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter.
- Product
- Warehouse Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.CVE-2021-46101 · Other software · Gitforwindows · reported by MITREHigh 7.5
In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
- Product
- GIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50.CVE-2021-42063 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data.
- Product
- SAP Knowledge Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 12, 2021The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user CVE-2021-21468 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table.
- Product
- SAP Business Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 12, 2021SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject codeCVE-2021-21466 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.
- Product
- SAP Business Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 12, 2021The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database.CVE-2021-21465 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.9
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.
- Product
- SAP Business Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 9, 2020SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticCVE-2020-26838 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.1
SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it.
- Product
- SAP Business Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 1, 2020A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 allows remote attackerCVE-2020-23836 · Other software · Oswapp · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site.
- Product
- Warehouse Inventory System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 12, 2017Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding oCVE-2017-16685 · Network & remote access · SAP · reported by cna@sap.comMedium 6.1
Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding of user controlled inputs.
- Product
- SAP Business Warehouse Universal Data Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.sap.com
Apr 24, 2017Vulnerability in the Oracle Retail Warehouse Management System component of Oracle Retail Applications (subcomponent: Security).CVE-2017-3532 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Retail Warehouse Management System component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.2, 14.0 and 15.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Warehouse Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Warehouse Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Warehouse Management System accessible data as well as unauthorized read access to a subset of Oracle Retail Warehouse Management System accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Retail Warehouse Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Apr 11, 2017A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA).CVE-2017-7691 · Network & remote access · SAP · reported by MITRECritical 9.8
A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). The vendor response is SAP Security Note 2419592.
- Product
- Trex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.sap.com
Feb 2, 2017The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privilegedCVE-2017-5600 · Other software · Netapp · reported by MITRECritical 9.8
The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privileged account.
- Product
- Oncommand Insight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.netapp.com
Nov 6, 2014SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspeciCVE-2014-8663 · Network & remote access · SAP · reported by MITREHigh 7.5
SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Netweaver Business Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.onapsis.comservice.sap.com
Oct 16, 2014Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFICVE-2014-8312 · Network & remote access · SAP · reported by MITRELow 3.5
Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
- Product
- Netweaver Abap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comscn.sap.com
Jul 31, 2014The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote autheCVE-2014-5174 · Network & remote access · SAP · reported by MITRELow 3.5
The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
- Product
- Netweaver Business Warehouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comscn.sap.com
May 30, 2014The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the histoCVE-2014-0202 · Other software · Redhat · reported by Red HatLow 2.1
The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
- Product
- Rhevm-dwh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Sep 19, 2012Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbCVE-2012-0988 · Other software · JAM Warehouse · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php.
- Product
- Knowledgetree Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Apr 19, 2011Unspecified vulnerability in the Oracle Warehouse Builder component in Oracle Database Server 10.2.0.5 (OWB), 11.1.0.7, and 11.2.0.1 allows remote authenticatedCVE-2011-0799 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6.5
Unspecified vulnerability in the Oracle Warehouse Builder component in Oracle Database Server 10.2.0.5 (OWB), 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Oracle Warehouse Builder User Account.
- Product
- Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2011Unspecified vulnerability in the Oracle Warehouse Builder component in Oracle Database Server 10.2.0.5 (OWB) and 11.1.0.7 allows remote authenticated users to aCVE-2011-0792 · Other software · Oracle · reported by secalert_us@oracle.comMedium 6.5
Unspecified vulnerability in the Oracle Warehouse Builder component in Oracle Database Server 10.2.0.5 (OWB) and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Dimensional Data Modeling.
- Product
- Database Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2009Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local CVE-2008-6177 · Other software · Publicwarehouse · reported by MITREMedium 6.8
Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.
- Product
- Lightblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.