Sap

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-8310 1Sap 1Businessobjects May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 7.1 HIGH· v2 The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
CVE-2014-8309 1Sap 2Businessobjects Businessobjects Xi May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers...Show more SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.Show less
CVE-2014-8308 1Sap 1Businessobjects May 6, 2026 Oct 16, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-6252 1Sap 1Netweaver May 6, 2026 Sep 5, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspec...Show more Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors.Show less
CVE-2014-5506 1Sap 1Crystal Reports May 6, 2026 Sep 4, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
CVE-2014-5505 1Sap 1Crystal Reports May 6, 2026 Sep 4, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
CVE-2014-5176 1Sap 1Fi Manager Self Service May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 6.0 MEDIUM· v2 SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2014-5175 1Sap 1Solution Manager May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
CVE-2014-5174 1Sap 1Netweaver Business Warehouse May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecifi...Show more The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.Show less
CVE-2014-5173 1Sap 1Hana Extended Application Services May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.
CVE-2014-5172 1Sap 1Hana May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-5171 1Sap 1Hana Extended Application Services May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 2.9 LOW· v2 SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive informati...Show more SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.Show less
CVE-2014-4161 1Sap 1Supplier Relationship Management May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2014-4160 1Sap 1Netweaver Business Client May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) sap-accessibility...Show more Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) sap-accessibility parameter.Show less
CVE-2014-4159 1Sap 1Supplier Relationship Management May 6, 2026 Jun 13, 2014 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parame...Show more Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.Show less
CVE-2014-4012 1Sap 1Open Hub Service May 6, 2026 Jun 9, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2014-4011 1Sap 1Capacity Leveling May 6, 2026 Jun 9, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2014-4010 1Sap 1Transaction Data Pool May 6, 2026 Jun 9, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2014-4009 1Sap 1Computing Center Management System Monitoring May 6, 2026 Jun 9, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2014-4008 1Sap 1Web Services Tool May 6, 2026 Jun 9, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

Previous 1...707172...80 Next