SAP SE
Page 3 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40497 | Medium | 5.3 | 2021-10-12 | SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These… |
CVE-2021-40496 | Medium | 4.3 | 2021-10-12 | SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon funct… |
CVE-2021-40495 | Medium | 5.3 | 2021-10-12 | There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 75… |
CVE-2021-38183 | Medium | 6.1 | 2021-10-12 | SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a… |
CVE-2021-38181 | High | 7.5 | 2021-10-12 | SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate us… |
CVE-2021-38180 | Critical | 9.8 | 2021-10-12 | SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data… |
CVE-2021-38179 | Medium | 4.9 | 2021-10-12 | Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include… |
CVE-2021-38178 | High | 8.8 | 2021-10-12 | The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enabl… |
CVE-2021-33705 | High | 8.1 | 2021-09-15 | The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerabil… |
CVE-2021-33704 | High | 8.8 | 2021-09-15 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to speci… |
CVE-2021-33701 | Critical | 9.1 | 2021-09-15 | DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCOR… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2021-33698 | High | 8.8 | 2021-09-15 | SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format va… |
CVE-2021-33697 | Medium | 6.1 | 2021-09-15 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect u… |
CVE-2021-33696 | Medium | 5.4 | 2021-09-15 | SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an… |
CVE-2021-33695 | Critical | 9.1 | 2021-09-15 | Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate. |
CVE-2021-33694 | Medium | 4.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious c… |
CVE-2021-33693 | Medium | 6.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead… |
CVE-2021-33692 | High | 7.5 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' s… |
CVE-2021-33691 | Medium | 6.1 | 2021-09-15 | NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabili… |
CVE-2021-33690 | Critical | 9.9 | 2021-09-15 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.2… |
CVE-2021-38177 | High | 7.5 | 2021-09-14 | SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious da… |
CVE-2021-38176 | High | 8.8 | 2021-09-14 | Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section t… |
CVE-2021-38175 | Medium | 6.5 | 2021-09-14 | SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change informat… |
CVE-2021-38174 | Medium | 6.5 | 2021-09-14 | When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes tempora… |
CVE-2021-38164 | Medium | 5.4 | 2021-09-14 | SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4C… |
CVE-2021-38163 | Critical | 9.9 | 2021-09-14 | SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can uploa… |
CVE-2021-38162 | High | 8.9 | 2021-09-14 | SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7… |
CVE-2021-38150 | Medium | 6.5 | 2021-09-14 | When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client ver… |
CVE-2021-37535 | Critical | 9.8 | 2021-09-14 | SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks fo… |
CVE-2021-37532 | Medium | 4.3 | 2021-09-14 | SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the… |
CVE-2021-37531 | High | 8.8 | 2021-09-14 | SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative au… |
CVE-2021-33688 | Medium | 4.3 | 2021-09-14 | SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions… |
CVE-2021-33686 | Medium | 5.3 | 2021-09-14 | Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not… |
CVE-2021-33685 | Medium | 6.5 | 2021-09-14 | SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restric… |
CVE-2021-33679 | Medium | 5.4 | 2021-09-14 | The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a ne… |
CVE-2021-33675 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected… |
CVE-2021-33674 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected… |
CVE-2021-33673 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to… |
CVE-2021-33672 | Critical | 9.6 | 2021-09-14 | Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the… |
CVE-2021-21489 | Medium | 4.8 | 2021-09-14 | SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-… |
CVE-2021-33708 | High | 8.8 | 2021-08-10 | Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges. |
CVE-2021-33707 | Medium | 6.1 | 2021-08-10 | SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component… |
CVE-2021-33706 | Medium | 4.3 | 2021-08-10 | Due to improper input validation in InfraBox, logs can be modified by an authenticated user. |
CVE-2021-33703 | Medium | 6.1 | 2021-08-10 | Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a… |
CVE-2021-33702 | Medium | 6.1 | 2021-08-10 | Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attack… |
CVE-2021-33699 | Medium | 6.5 | 2021-08-10 | Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Ta… |
CVE-2021-33689 | Medium | 4.3 | 2021-07-14 | When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security… |
CVE-2021-33687 | Medium | 4.9 | 2021-07-14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attack… |
CVE-2021-33684 | Medium | 5.3 | 2021-07-14 | SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.2… |
CVE-2021-33683 | Medium | 4.3 | 2021-07-14 | SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NU… |
CVE-2021-33682 | Medium | 5.4 | 2021-07-14 | SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an a… |
CVE-2021-33681 | Medium | 6.5 | 2021-07-14 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and c… |
CVE-2021-33680 | Medium | 6.5 | 2021-07-14 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and cause… |
CVE-2021-33678 | Medium | 6.5 | 2021-07-14 | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75… |
CVE-2021-33677 | High | 7.5 | 2021-07-14 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disc… |
CVE-2021-33676 | High | 7.2 | 2021-07-14 | A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentia… |
CVE-2021-33671 | High | 8.8 | 2021-07-14 | SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for an… |
CVE-2021-33670 | High | 7.5 | 2021-07-14 | SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP reque… |
CVE-2021-33667 | Medium | 4.3 | 2021-07-14 | Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source code, through SDK c… |
CVE-2021-27610 | Critical | 9.8 | 2021-06-16 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal… |
CVE-2021-33669 | High | 7.8 | 2021-06-09 | Under certain conditions, SAP Mobile SDK Certificate Provider allows a local unprivileged attacker to exploit an insecure temporary file storage. For a success… |
CVE-2021-33666 | Medium | 6.1 | 2021-06-09 | When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facili… |
CVE-2021-33665 | Medium | 5.4 | 2021-06-09 | SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81… |
CVE-2021-33664 | Medium | 5.4 | 2021-06-09 | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficien… |
CVE-2021-33663 | Medium | 5.3 | 2021-06-09 | SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73… |
CVE-2021-33662 | Medium | 4.4 | 2021-06-09 | Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to acce… |
CVE-2021-33661 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-33660 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the appli… |
CVE-2021-33659 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27643 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27642 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27641 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27640 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the appli… |
CVE-2021-27639 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applic… |
CVE-2021-27638 | Medium | 5.5 | 2021-06-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applic… |
CVE-2021-27637 | Medium | 4.6 | 2021-06-09 | Under certain conditions SAP Enable Now (SAP Workforce Performance Builder - Manager), versions - 1.0, 10 allows an attacker to access information which would… |
CVE-2021-27635 | Medium | 6.5 | 2021-06-09 | SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a… |
CVE-2021-27634 | Medium | 5.9 | 2021-06-09 | SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNE… |
CVE-2021-27633 | High | 7.5 | 2021-06-09 | SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNE… |
CVE-2021-27632 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27631 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27630 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27629 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27628 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC… |
CVE-2021-27627 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27626 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27625 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27624 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27623 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27622 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27621 | Medium | 4.9 | 2021-06-09 | Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows… |
CVE-2021-27620 | Medium | 5.9 | 2021-06-09 | SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value c… |
CVE-2021-27615 | Medium | 5.4 | 2021-06-09 | SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers i… |
CVE-2021-27607 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC… |
CVE-2021-27606 | High | 7.5 | 2021-06-09 | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT… |
CVE-2021-27597 | High | 7.5 | 2021-06-09 | SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNE… |
CVE-2021-21490 | Medium | 6.1 | 2021-06-09 | SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output paramet… |
CVE-2021-21473 | Medium | 6.3 | 2021-06-09 | SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_RE… |
CVE-2021-33668 | High | 7.5 | 2021-06-09 | Due to improper input sanitization, specially crafted LDAP queries can be injected by an unauthenticated user. This could partially impact the confidentiality… |