Sap
sap
1,576 CVEs • 429 products
Products (429)
Click to collapseToggle
Products (429)
Click to collapse
CVEs (1,576)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). |
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
1Sap 5Netweaver Internet Communication Manager (kernel) Netweaver Internet Communication Manager (krnl32nuc)Netweaver Internet Communication Manager (krnl32uc)+2 moreNov 21, 2024 Jan 14, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7...Show more |
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. |
1Sap 2Enterprise Extension Financial Services Treasury And Risk Management (s4core)Nov 21, 2024 Dec 17, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary autho...Show more |
1Sap 2Enterprise Extension Financial Services Treasury And Risk Management (s4core)Nov 21, 2024 Dec 17, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary autho...Show more |
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure. |
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure. |
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection. |
1Sap 1Adaptive Server Enterprise Nov 21, 2024 Dec 11, 2019 N/A· v4 4.4 MEDIUM· v3 2.1 LOW· v2 SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information Disclosure. |
1Sap 1Portfolio And Project Management Nov 21, 2024 Dec 11, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discover accounting information of the Projects in Project dashboard...Show more |
1Sap 1Businessobjects Business Intelligence Platform Nov 21, 2024 Dec 11, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web...Show more |
1Sap 1Businessobjects Business Intelligence Platform Nov 21, 2024 Dec 11, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to Stored Cross Site Scripting vulnerability. |
1Sap 1Businessobjects Business Intelligence Platform Nov 21, 2024 Nov 13, 2019 N/A· v4 7.1 HIGH· v3 5.5 MEDIUM· v2 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can c...Show more |
SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insufficient URL validation. |
Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization...Show more |
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields of historical inspec...Show more |
1Sap 1Netweaver Application Server Java Nov 21, 2024 Nov 13, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted. |
Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted. Connection details that are maintained in Connection Manager are...Show more |
1Sap 1Netweaver Application Server Java Nov 21, 2024 Nov 13, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for all or some functions in Java Server, and enable users to execu...Show more |