Sap

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-8587 1Sap 5Commoncryptolib HanaNetweaver+2 more May 6, 2026 Nov 4, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecifie...Show more SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.Show less
CVE-2014-8316 1Sap 1Businessobjects Explorer May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate req...Show more XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.Show less
CVE-2014-8315 1Sap 1Businessobjects Explorer May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and...Show more polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter.Show less
CVE-2014-8314 1Sap 1Hana May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) epm/admin/DataGen.xsjs or (2) epm...Show more Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) epm/admin/DataGen.xsjs or (2) epm/services/multiply.xsjs in the democontent.Show less
CVE-2014-8313 1Sap 1Hana May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 6.0 MEDIUM· v2 Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified vectors.
CVE-2014-8312 1Sap 1Netweaver Abap May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
CVE-2014-8311 1Sap 1Businessobjects May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.
CVE-2014-8310 1Sap 1Businessobjects May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
CVE-2014-8309 1Sap 2Businessobjects Businessobjects Xi May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers...Show more SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.Show less
CVE-2014-8308 1Sap 1Businessobjects May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-6252 1Sap 1Netweaver May 6, 2026 Sep 5, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspec...Show more Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors.Show less
CVE-2014-5506 1Sap 1Crystal Reports May 6, 2026 Sep 4, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
CVE-2014-5505 1Sap 1Crystal Reports May 6, 2026 Sep 4, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
CVE-2014-5176 1Sap 1Fi Manager Self Service May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 6.0 MEDIUM· v2 SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2014-5175 1Sap 1Solution Manager May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
CVE-2014-5174 1Sap 1Netweaver Business Warehouse May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecifi...Show more The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.Show less
CVE-2014-5173 1Sap 1Hana Extended Application Services May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.
CVE-2014-5172 1Sap 1Hana May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-5171 1Sap 1Hana Extended Application Services May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 2.9 LOW· v2 SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive informati...Show more SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.Show less
CVE-2014-4161 1Sap 1Supplier Relationship Management May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Previous 1...697071...79 Next