SAP SE
Page 4 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27619 | Medium | 6.5 | 2021-05-11 | SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are not supposed to be d… |
CVE-2021-27618 | Medium | 4.9 | 2021-05-11 | The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the… |
CVE-2021-27617 | Medium | 4.9 | 2021-05-11 | The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML documen… |
CVE-2021-27616 | High | 7.8 | 2021-05-11 | Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One for SAP HANA, allows… |
CVE-2021-27614 | High | 7.1 | 2021-05-11 | SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attacker to inject code… |
CVE-2021-27613 | High | 7.8 | 2021-05-11 | Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to exploit an insecure… |
CVE-2021-27612 | Medium | 6.1 | 2021-05-11 | In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or… |
CVE-2021-27611 | Medium | 6.7 | 2021-05-11 | SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attac… |
CVE-2021-27608 | High | 7.5 | 2021-04-14 | An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable fi… |
CVE-2021-27604 | Medium | 6.5 | 2021-04-14 | In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA… |
CVE-2021-27599 | Medium | 6.5 | 2021-04-14 | SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker… |
CVE-2021-27609 | Medium | 6.5 | 2021-04-13 | SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and… |
CVE-2021-27605 | Medium | 4.3 | 2021-04-13 | SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to r… |
CVE-2021-27603 | Medium | 6.5 | 2021-04-13 | An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. A… |
CVE-2021-27602 | Critical | 9.9 | 2021-04-13 | SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to dr… |
CVE-2021-27601 | Medium | 5.4 | 2021-04-13 | SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tr… |
CVE-2021-27600 | Medium | 5.4 | 2021-04-13 | SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and se… |
CVE-2021-27598 | Medium | 5.3 | 2021-04-13 | SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version… |
CVE-2021-21492 | Medium | 4.3 | 2021-04-13 | SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, r… |
CVE-2021-21485 | Medium | 6.5 | 2021-04-13 | An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attack… |
CVE-2021-21483 | Medium | 4.9 | 2021-04-13 | Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serio… |
CVE-2021-21482 | High | 8.3 | 2021-04-13 | SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password u… |
CVE-2021-27596 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cr… |
CVE-2021-27595 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes… |
CVE-2021-27594 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becom… |
CVE-2021-27593 | Low | 3.3 | 2021-03-22 | When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cras… |
CVE-2021-21491 | Medium | 6.1 | 2021-03-10 | SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redi… |
CVE-2021-27592 | High | 7.8 | 2021-03-09 | When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes… |
CVE-2021-27591 | High | 7.8 | 2021-03-09 | When a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the ap… |
CVE-2021-27590 | High | 7.8 | 2021-03-09 | When a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the appl… |
CVE-2021-27589 | High | 7.8 | 2021-03-09 | When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the ap… |
CVE-2021-27588 | High | 7.8 | 2021-03-09 | When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becom… |
CVE-2021-27587 | High | 7.8 | 2021-03-09 | When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applica… |
CVE-2021-27586 | High | 7.8 | 2021-03-09 | When a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the app… |
CVE-2021-27585 | High | 7.8 | 2021-03-09 | When a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the… |
CVE-2021-27584 | Low | 3.3 | 2021-03-09 | When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applicat… |
CVE-2021-21493 | Low | 3.3 | 2021-03-09 | When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the… |
CVE-2021-21488 | Medium | 6.5 | 2021-03-09 | Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without ver… |
CVE-2021-21487 | High | 8.8 | 2021-03-09 | SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2021-21486 | High | 8.8 | 2021-03-09 | SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization chec… |
CVE-2021-21484 | Critical | 9.8 | 2021-03-09 | LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. |
CVE-2021-21481 | High | 8.8 | 2021-03-09 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might all… |
CVE-2021-21480 | High | 8.8 | 2021-03-09 | SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to… |
CVE-2021-21479 | Critical | 9.1 | 2021-02-09 | In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system. |
CVE-2021-21478 | Medium | 6.1 | 2021-02-09 | SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. |
CVE-2021-21477 | Critical | 9.9 | 2021-02-09 | SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with th… |
CVE-2021-21476 | Medium | 6.1 | 2021-02-09 | SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious… |
CVE-2021-21475 | High | 7.5 | 2021-02-09 | Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path in… |
CVE-2021-21474 | Medium | 6.5 | 2021-02-09 | SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for a… |
CVE-2021-21472 | High | 8.8 | 2021-02-09 | SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this a… |
CVE-2021-21444 | Medium | 6.1 | 2021-02-09 | SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictab… |
CVE-2021-21471 | Medium | 6.5 | 2021-01-12 | In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by t… |
CVE-2021-21470 | Medium | 4.4 | 2021-01-12 | SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privi… |
CVE-2021-21469 | High | 7.5 | 2021-01-12 | When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external op… |
CVE-2021-21468 | Medium | 6.5 | 2021-01-12 | The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user… |
CVE-2021-21467 | Medium | 4.3 | 2021-01-12 | SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An… |
CVE-2021-21466 | High | 8.8 | 2021-01-12 | SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject cod… |
CVE-2021-21465 | Critical | 9.9 | 2021-01-12 | The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can includ… |
CVE-2021-21464 | Medium | 4.3 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21463 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21462 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21461 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21460 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21459 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21458 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21457 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21456 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21455 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21454 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21453 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21452 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21451 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21450 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21449 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21448 | Medium | 6.5 | 2021-01-12 | SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under… |
CVE-2021-21447 | Medium | 5.4 | 2021-01-12 | SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom… |
CVE-2021-21446 | High | 7.5 | 2021-01-12 | SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, eit… |
CVE-2021-21445 | Medium | 5.4 | 2021-01-12 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type hea… |
CVE-2020-26838 | Critical | 9.1 | 2020-12-09 | SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenti… |
CVE-2020-26837 | Critical | 9.1 | 2020-12-09 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing pa… |
CVE-2020-26836 | Medium | 6.1 | 2020-12-09 | SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attack… |
CVE-2020-26835 | Medium | 6.1 | 2020-12-09 | SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in th… |
CVE-2020-26834 | Medium | 5.4 | 2020-12-09 | SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manip… |
CVE-2020-26832 | High | 7.6 | 2020-12-09 | SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA… |
CVE-2020-26831 | Critical | 9.6 | 2020-12-09 | SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generati… |
CVE-2020-26830 | High | 8.1 | 2020-12-09 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequ… |
CVE-2020-26829 | Critical | 10.0 | 2020-12-09 | SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missin… |
CVE-2020-26828 | Medium | 6.4 | 2020-12-09 | SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types… |
CVE-2020-26826 | Medium | 6.5 | 2020-12-09 | Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without pr… |
CVE-2020-26816 | Medium | 4.5 | 2020-12-09 | SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key S… |
CVE-2020-6317 | Low | 3.5 | 2020-11-30 | In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears… |
CVE-2020-26825 | Medium | 6.1 | 2020-11-13 | SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Applicati… |
CVE-2020-6316 | Medium | 4.3 | 2020-11-10 | SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Autho… |
CVE-2020-26824 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the U… |
CVE-2020-26823 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the U… |
CVE-2020-26822 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the O… |
CVE-2020-26821 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the S… |
CVE-2020-26820 | High | 7.2 | 2020-11-10 | SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, t… |
CVE-2020-26819 | High | 8.8 | 2020-11-10 | SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that… |
CVE-2020-26818 | High | 8.8 | 2020-11-10 | SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which… |