Sap

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-0261 1Sap 1Landscape Management Jun 17, 2026 Feb 15, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (ru...Show more Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).Show less
CVE-2019-0259 1Sap 1Businessobjects Jun 17, 2026 Feb 15, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.
CVE-2019-0258 1Sap 1Disclosure Management Jun 17, 2026 Feb 15, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVE-2019-0257 1Sap 2Netweaver Application Server Abap Netweaver As Abap Jun 17, 2026 Feb 15, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks...Show more Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.Show less
CVE-2019-0256 1Sap 1Business One Jun 17, 2026 Feb 15, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted.
CVE-2019-0255 1Sap 3Advanced Business Application Programming Platform Kernel Advanced Business Application Programming Platform Krnl64nucAdvanced Business Application Programming Platform Krnl64uc Jun 17, 2026 Feb 15, 2019 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where busines...Show more SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality.Show less
CVE-2019-0254 1Sap 1Disclosure Management Jun 17, 2026 Feb 15, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2019-0251 1Sap 1Businessobjects Jun 17, 2026 Feb 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2019-0249 1Sap 1Landscape Management Jun 17, 2026 Jan 8, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.
CVE-2019-0248 1Sap 2Basis Netweaver Jun 17, 2026 Jan 8, 2019 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.
CVE-2019-0247 1Sap 1Cloud Connector Jun 17, 2026 Jan 8, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVE-2019-0246 1Sap 1Cloud Connector Jun 17, 2026 Jan 8, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.
CVE-2019-0245 1Sap 3Customer Relationship Management Webclient Ui S4fndSapscore Jun 17, 2026 Jan 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2019-0244 1Sap 3Customer Relationship Management Webclient Ui S4fndSapscore Jun 17, 2026 Jan 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2019-0243 1Sap 1Bw/4hana Jun 17, 2026 Jan 8, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVE-2019-0241 1Sap 2Agentry Sdk Work Manager Jun 17, 2026 Jan 8, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVE-2019-0240 1Sap 1Businessobjects Mobile Jun 17, 2026 Jan 8, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legitimate users from accessing the application by crashing it.
CVE-2019-0238 1Sap 1Hybris Jun 17, 2026 Jan 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2018-2499 1Sap 2Financial Consolidation Cube Designer Financial Consolidation Cube Designer Bobj Eades Nov 21, 2024 Jan 8, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash of an admin user.
CVE-2018-2484 1Sap 4Bank/cfm Ea FinservS4core+1 more Nov 21, 2024 Jan 8, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary...Show more SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.Show less

Previous 1...535455...80 Next