SAP SE
Page 6 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6276 | Medium | 6.1 | 2020-07-14 | SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scrip… |
CVE-2020-6267 | Medium | 5.4 | 2020-07-14 | Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag. |
CVE-2020-6261 | Medium | 5.3 | 2020-07-01 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The r… |
CVE-2020-6275 | Critical | 9.8 | 2020-06-10 | SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in… |
CVE-2020-6271 | High | 8.2 | 2020-06-10 | SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of me… |
CVE-2020-6270 | Medium | 6.5 | 2020-06-10 | SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for… |
CVE-2020-6269 | Medium | 6.5 | 2020-06-10 | Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be re… |
CVE-2020-6268 | High | 8.1 | 2020-06-10 | Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 10… |
CVE-2020-6266 | Medium | 5.4 | 2020-06-10 | SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading… |
CVE-2020-6264 | High | 7.5 | 2020-06-10 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leadi… |
CVE-2020-6263 | Critical | 9.8 | 2020-06-10 | Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CO… |
CVE-2020-6260 | Medium | 5.3 | 2020-06-10 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete X… |
CVE-2020-6246 | Medium | 6.1 | 2020-06-10 | SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficient… |
CVE-2020-6239 | Medium | 4.4 | 2020-06-10 | Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear… |
CVE-2020-6265 | Critical | 9.8 | 2020-06-09 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication… |
CVE-2020-6262 | High | 8.8 | 2020-05-12 | Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacke… |
CVE-2020-6259 | Medium | 6.5 | 2020-05-12 | Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted lead… |
CVE-2020-6258 | Medium | 6.5 | 2020-05-12 | SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitiv… |
CVE-2020-6257 | Medium | 5.4 | 2020-05-12 | SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scr… |
CVE-2020-6256 | Medium | 4.3 | 2020-05-12 | SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details without having required… |
CVE-2020-6254 | Medium | 6.1 | 2020-05-12 | SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the… |
CVE-2020-6253 | High | 7.2 | 2020-05-12 | Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries… |
CVE-2020-6252 | High | 8.0 | 2020-05-12 | Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sensitive and confiden… |
CVE-2020-6251 | Medium | 6.5 | 2020-05-12 | Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which wo… |
CVE-2020-6250 | Medium | 6.8 | 2020-05-12 | SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the adjacent network, to… |
CVE-2020-6249 | High | 8.8 | 2020-05-12 | The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute… |
CVE-2020-6248 | High | 7.2 | 2020-05-12 | SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP o… |
CVE-2020-6247 | High | 7.5 | 2020-05-12 | SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Usin… |
CVE-2020-6245 | Medium | 6.7 | 2020-05-12 | SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed… |
CVE-2020-6244 | High | 7.8 | 2020-05-12 | SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directori… |
CVE-2020-6243 | High | 8.8 | 2020-05-12 | Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an aut… |
CVE-2020-6242 | Critical | 9.8 | 2020-05-12 | SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Managemen… |
CVE-2020-6241 | High | 8.8 | 2020-05-12 | SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, le… |
CVE-2020-6240 | High | 7.5 | 2020-05-12 | SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to preve… |
CVE-2020-6213 | Medium | 6.1 | 2020-04-24 | SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to r… |
CVE-2020-6212 | Medium | 5.4 | 2020-04-24 | Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA… |
CVE-2020-6225 | High | 8.8 | 2020-04-14 | SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently va… |
CVE-2020-6217 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode… |
CVE-2020-6215 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redire… |
CVE-2020-6211 | Medium | 6.1 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficie… |
CVE-2020-6195 | Critical | 9.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It in… |
CVE-2020-6238 | Critical | 9.3 | 2020-04-14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida… |
CVE-2020-6237 | High | 7.5 | 2020-04-14 | Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access informa… |
CVE-2020-6236 | High | 7.2 | 2020-04-14 | SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permiss… |
CVE-2020-6235 | High | 8.6 | 2020-04-14 | SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to… |
CVE-2020-6234 | High | 7.2 | 2020-04-14 | SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating sys… |
CVE-2020-6233 | Medium | 4.3 | 2020-04-14 | SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analys… |
CVE-2020-6232 | Medium | 5.3 | 2020-04-14 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects conf… |
CVE-2020-6231 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, result… |
CVE-2020-6230 | High | 7.2 | 2020-04-14 | SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and le… |
CVE-2020-6229 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75… |
CVE-2020-6228 | High | 7.5 | 2020-04-14 | SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify… |
CVE-2020-6227 | High | 7.5 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several ser… |
CVE-2020-6226 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, result… |
CVE-2020-6224 | Medium | 6.2 | 2020-04-14 | SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensit… |
CVE-2020-6223 | Medium | 6.1 | 2020-04-14 | The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malici… |
CVE-2020-6222 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2020-6221 | Medium | 5.4 | 2020-04-14 | Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2020-6219 | High | 8.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta… |
CVE-2020-6218 | Medium | 5.0 | 2020-04-14 | Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should o… |
CVE-2020-6216 | Medium | 6.1 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cr… |
CVE-2020-6214 | Medium | 4.7 | 2020-04-14 | SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected wi… |
CVE-2020-6210 | Medium | 6.1 | 2020-03-10 | SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the l… |
CVE-2020-6209 | High | 7.5 | 2020-03-10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts… |
CVE-2020-6208 | High | 8.2 | 2020-03-10 | SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can… |
CVE-2020-6207 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin… |
CVE-2020-6206 | Medium | 4.3 | 2020-03-10 | SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim t… |
CVE-2020-6205 | Medium | 6.1 | 2020-03-10 | SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; do… |
CVE-2020-6204 | Medium | 4.3 | 2020-03-10 | The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE ve… |
CVE-2020-6203 | Critical | 9.1 | 2020-03-10 | SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of pat… |
CVE-2020-6202 | High | 7.2 | 2020-03-10 | SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP dat… |
CVE-2020-6201 | Medium | 6.1 | 2020-03-10 | The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL p… |
CVE-2020-6200 | Medium | 5.4 | 2020-03-10 | The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scri… |
CVE-2020-6199 | Medium | 5.4 | 2020-03-10 | The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Managemen… |
CVE-2020-6198 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo… |
CVE-2020-6197 | Low | 3.3 | 2020-03-10 | SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local… |
CVE-2020-6196 | High | 7.5 | 2020-03-10 | SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting… |
CVE-2020-6178 | Medium | 5.4 | 2020-03-10 | SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Informati… |
CVE-2020-6193 | Medium | 6.1 | 2020-02-12 | SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to R… |
CVE-2020-6192 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP La… |
CVE-2020-6191 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP… |
CVE-2020-6190 | Medium | 5.8 | 2020-02-12 | Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system l… |
CVE-2020-6189 | Medium | 5.3 | 2020-02-12 | Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-n… |
CVE-2020-6188 | High | 8.8 | 2020-02-12 | VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 1… |
CVE-2020-6187 | Medium | 4.9 | 2020-02-12 | SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised a… |
CVE-2020-6186 | High | 7.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, le… |
CVE-2020-6185 | Medium | 5.4 | 2020-02-12 | Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), all… |
CVE-2020-6184 | Medium | 6.1 | 2020-02-12 | Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), do… |
CVE-2020-6183 | Medium | 6.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL proce… |
CVE-2020-6181 | Medium | 5.8 | 2020-02-12 | Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750… |
CVE-2020-6177 | Medium | 4.3 | 2020-02-12 | SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of servic… |
CVE-2020-6307 | Medium | 4.3 | 2020-01-14 | Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization… |
CVE-2020-6306 | Low | 2.7 | 2020-01-14 | Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). |
CVE-2020-6305 | Medium | 6.1 | 2020-01-14 | PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cro… |
CVE-2020-6304 | High | 7.5 | 2020-01-14 | Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRN… |
CVE-2020-6303 | Medium | 5.4 | 2020-01-14 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. |
CVE-2019-0384 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0383 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0405 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a us… |
CVE-2019-0404 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure. |