SAP SE
Page 2 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28771 | High | 7.5 | 2022-07-12 | Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests ove… |
CVE-2022-32243 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applicatio… |
CVE-2022-32242 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Radiance Picture (.hdr, hdr.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashe… |
CVE-2022-32241 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applic… |
CVE-2022-32240 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application… |
CVE-2022-32239 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and… |
CVE-2022-32238 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Encapsulated Post Script (.eps, ai.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application… |
CVE-2022-32237 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the appl… |
CVE-2022-32236 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes a… |
CVE-2022-32235 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cr… |
CVE-2022-31595 | High | 8.8 | 2022-06-14 | SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2022-31594 | Medium | 6.7 | 2022-06-14 | A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system. |
CVE-2022-31590 | High | 7.8 | 2022-06-14 | SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access… |
CVE-2022-31589 | Medium | 6.5 | 2022-06-14 | Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authori… |
CVE-2022-29618 | Medium | 6.1 | 2022-06-14 | Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenti… |
CVE-2022-29615 | Low | 3.4 | 2022-06-14 | SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confide… |
CVE-2022-29614 | Medium | 5.0 | 2022-06-14 | SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77… |
CVE-2022-29612 | Medium | 4.3 | 2022-06-14 | SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KR… |
CVE-2022-27668 | Critical | 9.8 | 2022-06-14 | Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administ… |
CVE-2022-28217 | Medium | 6.5 | 2022-06-13 | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary t… |
CVE-2022-29617 | Medium | 6.5 | 2022-06-06 | Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application. |
CVE-2020-6220 | Medium | 4.7 | 2022-06-06 | BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting… |
CVE-2022-29616 | High | 7.5 | 2022-05-11 | SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption. |
CVE-2022-29613 | Medium | 4.3 | 2022-05-11 | Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful e… |
CVE-2022-29611 | High | 8.8 | 2022-05-11 | SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of… |
CVE-2022-29610 | Medium | 5.4 | 2022-05-11 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Si… |
CVE-2022-28774 | Medium | 5.5 | 2022-05-11 | Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted. |
CVE-2022-28214 | High | 7.8 | 2022-05-11 | During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon… |
CVE-2022-27656 | Medium | 6.1 | 2022-05-11 | The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in… |
CVE-2022-28773 | High | 7.5 | 2022-04-12 | Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can… |
CVE-2022-28772 | High | 7.5 | 2022-04-12 | By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Intern… |
CVE-2022-28770 | Medium | 6.1 | 2022-04-12 | Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL… |
CVE-2022-28216 | Medium | 6.1 | 2022-04-12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker… |
CVE-2022-28215 | Medium | 4.7 | 2022-04-12 | SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insuffici… |
CVE-2022-28213 | High | 8.1 | 2022-04-12 | When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML docume… |
CVE-2022-27671 | Medium | 6.5 | 2022-04-12 | A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. |
CVE-2022-27670 | Medium | 6.5 | 2022-04-12 | SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the ser… |
CVE-2022-27669 | High | 7.5 | 2022-04-12 | An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be… |
CVE-2022-27667 | High | 7.5 | 2022-04-12 | Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access infor… |
CVE-2022-27657 | Low | 2.7 | 2022-04-12 | A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path i… |
CVE-2022-27655 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicatio… |
CVE-2022-27654 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applica… |
CVE-2022-26109 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26108 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-26107 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the a… |
CVE-2022-26106 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26105 | Medium | 6.1 | 2022-04-12 | SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker d… |
CVE-2022-22541 | Medium | 6.5 | 2022-04-12 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational… |
CVE-2022-27658 | High | 7.5 | 2022-03-28 | Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information gathering for furth… |
CVE-2022-26104 | Medium | 5.3 | 2022-03-10 | SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user… |
CVE-2022-26103 | Medium | 5.3 | 2022-03-10 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to informatio… |
CVE-2022-26102 | Medium | 5.4 | 2022-03-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access conten… |
CVE-2022-26101 | Medium | 6.1 | 2022-03-10 | Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2022-26100 | Critical | 9.8 | 2022-03-10 | SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obta… |
CVE-2022-24399 | Medium | 6.1 | 2022-03-10 | The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-dat… |
CVE-2022-24398 | Medium | 6.5 | 2022-03-10 | Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which… |
CVE-2022-24397 | Medium | 6.1 | 2022-03-10 | SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scrip… |
CVE-2022-24396 | High | 7.8 | 2022-03-10 | The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localho… |
CVE-2022-24395 | Medium | 6.1 | 2022-03-10 | SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflecte… |
CVE-2022-22547 | High | 7.5 | 2022-03-10 | Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9… |
CVE-2022-22546 | Medium | 5.4 | 2022-02-09 | Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launc… |
CVE-2022-22545 | Medium | 4.9 | 2022-02-09 | A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application S… |
CVE-2022-22544 | Critical | 9.1 | 2022-02-09 | Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse… |
CVE-2022-22543 | High | 7.5 | 2022-02-09 | SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC… |
CVE-2022-22542 | Medium | 6.5 | 2022-02-09 | S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer… |
CVE-2022-22540 | High | 7.5 | 2022-02-09 | SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted data… |
CVE-2022-22539 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-22538 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, t… |
CVE-2022-22537 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the… |
CVE-2022-22536 | Critical | 10.0 | 2022-02-09 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for… |
CVE-2022-22535 | Medium | 6.5 | 2022-02-09 | SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certa… |
CVE-2022-22534 | Medium | 6.1 | 2022-02-09 | Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and pas… |
CVE-2022-22533 | High | 7.5 | 2022-02-09 | Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7… |
CVE-2022-22532 | Critical | 9.8 | 2022-02-09 | In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthentic… |
CVE-2022-22528 | High | 7.8 | 2022-02-09 | SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certa… |
CVE-2022-22531 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22530 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22529 | Medium | 6.1 | 2022-01-14 | SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly ex… |
CVE-2021-44234 | Medium | 5.5 | 2022-01-14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitiv… |
CVE-2021-42067 | Medium | 4.3 | 2022-01-14 | In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a… |
CVE-2021-44235 | Medium | 6.7 | 2021-12-14 | Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker… |
CVE-2021-44233 | High | 8.8 | 2021-12-14 | SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead… |
CVE-2021-44232 | High | 7.7 | 2021-12-14 | SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server d… |
CVE-2021-44231 | Critical | 9.8 | 2021-12-14 | Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavio… |
CVE-2021-42070 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application… |
CVE-2021-42069 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic… |
CVE-2021-42068 | Low | 3.3 | 2021-12-14 | When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and b… |
CVE-2021-42066 | Medium | 4.4 | 2021-12-14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker… |
CVE-2021-42064 | Critical | 9.8 | 2021-12-14 | If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions… |
CVE-2021-42063 | Medium | 6.1 | 2021-12-14 | A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web b… |
CVE-2021-42061 | Medium | 5.4 | 2021-12-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2021-38182 | High | 8.8 | 2021-12-14 | Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the… |
CVE-2021-42062 | Medium | 4.3 | 2021-11-10 | SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affecte… |
CVE-2021-40504 | Medium | 4.9 | 2021-11-10 | A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 7… |
CVE-2021-40503 | High | 7.8 | 2021-11-10 | An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on… |
CVE-2021-40502 | High | 8.8 | 2021-11-10 | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation o… |
CVE-2021-40501 | High | 8.1 | 2021-11-10 | SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in es… |
CVE-2021-40500 | High | 7.5 | 2021-10-12 | SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations… |
CVE-2021-40499 | Critical | 9.8 | 2021-10-12 | Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an… |
CVE-2021-40498 | Medium | 5.5 | 2021-10-12 | A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legiti… |