Skip to content

Commit 9679265

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2qp6-v7mh-v798 GHSA-3mmv-v6g2-g7c6 GHSA-4772-pjcp-2xfr GHSA-4p53-w5pc-f48w GHSA-4x3m-wqv7-c7h3 GHSA-5429-v87q-pg8h GHSA-5j28-xwjp-v5gv GHSA-67mq-54j2-cv5m GHSA-6xvr-96w9-f64h GHSA-9m57-5mv3-fjx3 GHSA-cv7h-78v9-r3jf GHSA-jjvw-w74f-45qh GHSA-jm7g-m582-79q7 GHSA-jmwc-hm8x-6w23 GHSA-mg77-v38f-9pm9 GHSA-mwg5-cwh8-88m5 GHSA-w8gf-92gc-cx36 GHSA-wjx9-27x5-jwmf GHSA-x2gq-6c9p-44p8 GHSA-x6hw-xmff-xh6q GHSA-xmmh-wmh6-hp5h GHSA-xwwh-3hfg-5c8w
1 parent dea68e1 commit 9679265

22 files changed

Lines changed: 831 additions & 2 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-2qp6-v7mh-v798/GHSA-2qp6-v7mh-v798.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2qp6-v7mh-v798",
4+
"modified": "2026-01-13T03:32:08Z",
5+
"published": "2026-01-13T03:32:08Z",
6+
"aliases": [
7+
"CVE-2026-0497"
8+
],
9+
"details": "SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidentiality, with no impact on integrity or availability of the application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0497"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3677111"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:52Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-3mmv-v6g2-g7c6/GHSA-3mmv-v6g2-g7c6.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3mmv-v6g2-g7c6",
4+
"modified": "2026-01-13T03:32:09Z",
5+
"published": "2026-01-13T03:32:09Z",
6+
"aliases": [
7+
"CVE-2025-66176"
8+
],
9+
"details": "There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66176"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerabilities-in-some-hikvision-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2026-01-13T03:16:01Z"
33+
}
34+
}

‎advisories/unreviewed/2026/01/GHSA-4772-pjcp-2xfr/GHSA-4772-pjcp-2xfr.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4772-pjcp-2xfr",
4+
"modified": "2026-01-13T03:32:09Z",
5+
"published": "2026-01-13T03:32:09Z",
6+
"aliases": [
7+
"CVE-2026-0503"
8+
],
9+
"details": "Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0503"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3681523"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:52Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-4p53-w5pc-f48w/GHSA-4p53-w5pc-f48w.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p53-w5pc-f48w",
4+
"modified": "2026-01-13T03:32:08Z",
5+
"published": "2026-01-13T03:32:08Z",
6+
"aliases": [
7+
"CVE-2026-0498"
8+
],
9+
"details": "SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0498"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3694242"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-94"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:52Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-4x3m-wqv7-c7h3/GHSA-4x3m-wqv7-c7h3.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4x3m-wqv7-c7h3",
4+
"modified": "2026-01-13T03:32:09Z",
5+
"published": "2026-01-13T03:32:09Z",
6+
"aliases": [
7+
"CVE-2026-0507"
8+
],
9+
"details": "Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0507"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3675151"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:53Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-5429-v87q-pg8h/GHSA-5429-v87q-pg8h.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5429-v87q-pg8h",
4+
"modified": "2026-01-13T03:32:08Z",
5+
"published": "2026-01-13T03:32:08Z",
6+
"aliases": [
7+
"CVE-2026-0495"
8+
],
9+
"details": "SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0495"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3565506"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-15"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:51Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-5j28-xwjp-v5gv/GHSA-5j28-xwjp-v5gv.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j28-xwjp-v5gv",
4+
"modified": "2026-01-13T03:32:08Z",
5+
"published": "2026-01-13T03:32:08Z",
6+
"aliases": [
7+
"CVE-2026-0496"
8+
],
9+
"details": "SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper file format validation. This has low impact on confidentiality, integrity and availability of the application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0496"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3565506"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-434"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:51Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-67mq-54j2-cv5m/GHSA-67mq-54j2-cv5m.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-67mq-54j2-cv5m",
4+
"modified": "2026-01-13T03:32:08Z",
5+
"published": "2026-01-13T03:32:08Z",
6+
"aliases": [
7+
"CVE-2026-0492"
8+
],
9+
"details": "SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0492"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3691059"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-306"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:51Z"
39+
}
40+
}

‎advisories/unreviewed/2026/01/GHSA-6xvr-96w9-f64h/GHSA-6xvr-96w9-f64h.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6xvr-96w9-f64h",
4+
"modified": "2026-01-13T03:32:08Z",
5+
"published": "2026-01-13T03:32:08Z",
6+
"aliases": [
7+
"CVE-2026-0494"
8+
],
9+
"details": "Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0494"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://me.sap.com/notes/3655227"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://url.sap/sapsecuritypatchday"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-497"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-01-13T02:15:51Z"
39+
}
40+
}

0 commit comments

Comments
 (0)