SAP SE
Page 5 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26817 | High | 7.8 | 2020-11-10 | SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the app… |
CVE-2020-26815 | High | 8.6 | 2020-11-10 | SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web… |
CVE-2020-26814 | Medium | 4.9 | 2020-11-10 | SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Modu… |
CVE-2020-26811 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network… |
CVE-2020-26810 | High | 7.5 | 2020-11-10 | SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network… |
CVE-2020-26809 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence… |
CVE-2020-26808 | High | 7.2 | 2020-11-10 | SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 1… |
CVE-2020-26807 | Low | 3.3 | 2020-11-10 | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone t… |
CVE-2020-6370 | Medium | 4.8 | 2020-10-20 | SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2020-6369 | Medium | 5.9 | 2020-10-20 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the au… |
CVE-2020-6367 | Medium | 6.1 | 2020-10-20 | There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthent… |
CVE-2020-6366 | Medium | 6.5 | 2020-10-20 | SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privi… |
CVE-2020-6362 | Medium | 6.5 | 2020-10-20 | SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthoriza… |
CVE-2020-6315 | Medium | 5.5 | 2020-10-20 | SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of sensitive informati… |
CVE-2020-6308 | Medium | 5.3 | 2020-10-20 | SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CM… |
CVE-2020-6365 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicio… |
CVE-2020-6376 | Medium | 5.5 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted sources which result… |
CVE-2020-6375 | Medium | 5.5 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Computer Graphics Metafile (.cgm) file received from untrusted sources wh… |
CVE-2020-6374 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sources which results in… |
CVE-2020-6373 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6372 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6371 | Medium | 4.3 | 2020-10-15 | User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server… |
CVE-2020-6368 | Medium | 5.4 | 2020-10-15 | SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displaye… |
CVE-2020-6364 | Critical | 10.0 | 2020-10-15 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that… |
CVE-2020-6363 | Medium | 4.6 | 2020-10-15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established afte… |
CVE-2020-6323 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker… |
CVE-2020-6319 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks… |
CVE-2020-6272 | Medium | 5.4 | 2020-10-15 | SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to… |
CVE-2020-6324 | Medium | 6.1 | 2020-09-09 | SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send… |
CVE-2020-6311 | Medium | 6.5 | 2020-09-09 | Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform neces… |
CVE-2020-6361 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE files received from untrusted sources which results in crashing of the appl… |
CVE-2020-6360 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6359 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PLT file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6358 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6357 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6356 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6355 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6354 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6353 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6352 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6351 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6350 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6349 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6348 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6347 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6346 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6345 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6344 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6343 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6342 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6341 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6340 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6339 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6338 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RH file received from untrusted sources which results in crashing of the applic… |
CVE-2020-6337 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6336 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6335 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the appl… |
CVE-2020-6334 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6333 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6332 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the appl… |
CVE-2020-6331 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the appl… |
CVE-2020-6330 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6329 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6328 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6327 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6326 | Medium | 5.4 | 2020-09-09 | SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim… |
CVE-2020-6322 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6321 | Medium | 6.5 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6320 | High | 8.1 | 2020-09-09 | SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is… |
CVE-2020-6318 | High | 7.2 | 2020-09-09 | A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an atta… |
CVE-2020-6314 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the appl… |
CVE-2020-6313 | Medium | 6.5 | 2020-09-09 | SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authentic… |
CVE-2020-6312 | Medium | 5.4 | 2020-09-09 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user ac… |
CVE-2020-6302 | High | 8.1 | 2020-09-09 | SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get… |
CVE-2020-6288 | Medium | 5.3 | 2020-09-09 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (includin… |
CVE-2020-6283 | Medium | 6.1 | 2020-09-09 | SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using t… |
CVE-2020-6310 | Medium | 4.3 | 2020-08-12 | Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any a… |
CVE-2020-6309 | High | 7.5 | 2020-08-12 | SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication ch… |
CVE-2020-6301 | High | 8.1 | 2020-08-12 | SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settl… |
CVE-2020-6300 | Medium | 4.8 | 2020-08-12 | SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the… |
CVE-2020-6299 | Medium | 4.3 | 2020-08-12 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given sy… |
CVE-2020-6298 | High | 8.1 | 2020-08-12 | SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GM… |
CVE-2020-6297 | Medium | 4.4 | 2020-08-12 | Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential system configuratio… |
CVE-2020-6296 | High | 8.8 | 2020-08-12 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that ca… |
CVE-2020-6295 | High | 7.8 | 2020-08-12 | Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information throug… |
CVE-2020-6294 | Critical | 9.1 | 2020-08-12 | Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionaliti… |
CVE-2020-6293 | Medium | 6.5 | 2020-08-12 | SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modi… |
CVE-2020-6284 | Critical | 9.0 | 2020-08-12 | SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate fi… |
CVE-2020-6273 | Medium | 4.3 | 2020-08-12 | SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticated user working wit… |
CVE-2020-6292 | High | 8.8 | 2020-07-14 | Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration. |
CVE-2020-6291 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leadi… |
CVE-2020-6290 | Medium | 6.3 | 2020-07-14 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID. |
CVE-2020-6289 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malic… |
CVE-2020-6287 | Critical | 10.0 | 2020-07-14 | SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p… |
CVE-2020-6286 | Medium | 5.3 | 2020-07-14 | The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40… |
CVE-2020-6285 | Medium | 6.5 | 2020-07-14 | SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access in… |
CVE-2020-6282 | Medium | 5.8 | 2020-07-14 | SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), ve… |
CVE-2020-6281 | Medium | 6.1 | 2020-07-14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cr… |
CVE-2020-6280 | Low | 2.7 | 2020-07-14 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise… |
CVE-2020-6278 | Medium | 5.4 | 2020-07-14 | SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the applicat… |