Sap

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-15297 1Sap 1Host Agent May 13, 2026 Oct 16, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993.
CVE-2017-15296 1Sap 1Customer Relationship Management May 13, 2026 Oct 16, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.
CVE-2017-15295 1Sap 1Point Of Sale Xpress Server May 13, 2026 Oct 16, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064.
CVE-2017-15294 1Sap 1Customer Relationship Management May 13, 2026 Oct 16, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.
CVE-2017-15293 1Sap 1Point Of Sale Xpress Server May 13, 2026 Oct 16, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064.
CVE-2017-10701 1Sap 1Enterprise Portal May 13, 2026 Sep 29, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516.
CVE-2017-14581 1Sap 1Netweaver Application Server Java May 13, 2026 Sep 19, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181.
CVE-2017-14511 1Sap 1E Recruiting May 13, 2026 Sep 17, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email ad...Show more An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and confirm email addresses that they do not have access to (candidate_hrobject is predictable and corr_act_guid is improperly validated). Furthermore, since an email address can be registered only once, an attacker could prevent other legitimate users from registering. This is SAP Security Note 2507798.Show less
CVE-2015-7241 1Sap 1Netweaver May 13, 2026 Sep 6, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
CVE-2014-8871 1Sap 1Hybris May 13, 2026 Aug 28, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 and earlier, and 5.3.0.1 and earlier.
CVE-2017-12637 1Sap 1Netweaver Application Server Java Apr 22, 2026 Aug 7, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string...Show more Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.Show less
CVE-2017-11460 1Sap 1Netweaver Portal May 13, 2026 Jul 25, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp...Show more Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp, aka SAP Security Note 2308535.Show less
CVE-2017-11459 1Sap 1Trex May 13, 2026 Jul 25, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592.
CVE-2017-11458 1Sap 1Netweaver Application Server Java May 13, 2026 Jul 25, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note...Show more Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783.Show less
CVE-2017-11457 1Sap 1Netweaver Application Server Java May 13, 2026 Jul 25, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD...Show more XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249.Show less
CVE-2017-9845 1Sap 1Netweaver May 13, 2026 Jul 12, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918.
CVE-2017-9844 1Sap 1Netweaver May 2, 2025 Jul 12, 2017 N/A· v4 7.5 HIGH· v3 7.5 HIGH· v2 SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804...Show more SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.Show less
CVE-2017-9843 1Sap 1Netweaver Abap May 13, 2026 Jul 12, 2017 N/A· v4 2.7 LOW· v3 4.0 MEDIUM· v2 SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841.
CVE-2017-9613 1Sap 1Successfactors May 13, 2026 Jun 15, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b1705.1234962 allows remote authenticated users to inject arbitrary web script or HTML via the file upload functionality.
CVE-2016-6256 1Sap 1Business One May 13, 2026 May 26, 2017 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/IN...Show more SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.Show less

Previous 1...616263...80 Next