SAP SE
Page 7 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0403 | Critical | 9.8 | 2019-12-11 | SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Inject… |
CVE-2019-0402 | Medium | 4.4 | 2019-12-11 | SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information… |
CVE-2019-0399 | Medium | 6.5 | 2019-12-11 | SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discove… |
CVE-2019-0398 | High | 8.8 | 2019-12-11 | Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to… |
CVE-2019-0395 | Medium | 5.4 | 2019-12-11 | SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launch… |
CVE-2019-0396 | High | 7.1 | 2019-11-13 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML… |
CVE-2019-0388 | Medium | 5.3 | 2019-11-13 | SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insu… |
CVE-2019-0386 | Medium | 6.3 | 2019-11-13 | Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01… |
CVE-2019-0393 | Medium | 4.3 | 2019-11-13 | An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database… |
CVE-2019-0391 | Medium | 4.3 | 2019-11-13 | Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise… |
CVE-2019-0390 | Medium | 4.3 | 2019-11-13 | Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted. Conn… |
CVE-2019-0389 | High | 8.8 | 2019-11-13 | An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for al… |
CVE-2019-0385 | Medium | 6.5 | 2019-11-13 | SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2019-0382 | Medium | 5.4 | 2019-11-13 | A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in ve… |
CVE-2019-0350 | High | 7.5 | 2019-11-04 | SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA inst… |
CVE-2019-0381 | Medium | 5.5 | 2019-10-08 | A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the i… |
CVE-2019-0380 | Medium | 4.9 | 2019-10-08 | Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the ap… |
CVE-2019-0379 | Medium | 5.3 | 2019-10-08 | SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is c… |
CVE-2019-0378 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs a… |
CVE-2019-0377 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2019-0376 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled… |
CVE-2019-0375 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled… |
CVE-2019-0374 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled… |
CVE-2019-0370 | Medium | 6.5 | 2019-10-08 | Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the str… |
CVE-2019-0369 | Medium | 5.4 | 2019-10-08 | SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by… |
CVE-2019-0368 | Medium | 5.4 | 2019-10-08 | SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not suffi… |
CVE-2019-0367 | Medium | 4.3 | 2019-10-08 | SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowi… |
CVE-2019-0365 | High | 7.5 | 2019-09-10 | SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49… |
CVE-2019-0364 | Medium | 4.3 | 2019-09-10 | Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports. |
CVE-2019-0363 | High | 7.1 | 2019-09-10 | Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrie… |
CVE-2019-0361 | Medium | 6.1 | 2019-09-10 | SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-control… |
CVE-2019-0357 | Medium | 6.7 | 2019-09-10 | The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges. |
CVE-2019-0356 | Medium | 4.3 | 2019-09-10 | Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to… |
CVE-2019-0355 | High | 7.2 | 2019-09-10 | SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0… |
CVE-2019-0353 | Low | 3.3 | 2019-09-10 | Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would othe… |
CVE-2019-0352 | High | 7.5 | 2019-09-10 | In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker… |
CVE-2019-0349 | High | 7.2 | 2019-08-14 | SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.4… |
CVE-2019-0351 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this… |
CVE-2019-0348 | Medium | 6.5 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality… |
CVE-2019-0346 | Medium | 6.5 | 2019-08-14 | Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list o… |
CVE-2019-0345 | Critical | 9.8 | 2019-08-14 | A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7… |
CVE-2019-0344 | Critical | 9.8 | 2019-08-14 | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbi… |
CVE-2019-0343 | High | 8.8 | 2019-08-14 | SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that… |
CVE-2019-0341 | High | 8.8 | 2019-08-14 | The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application… |
CVE-2019-0340 | Medium | 5.4 | 2019-08-14 | The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. T… |
CVE-2019-0338 | Medium | 5.3 | 2019-08-14 | During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing… |
CVE-2019-0337 | Medium | 6.1 | 2019-08-14 | Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and a… |
CVE-2019-0335 | Medium | 6.1 | 2019-08-14 | Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a… |
CVE-2019-0334 | Medium | 5.4 | 2019-08-14 | When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script… |
CVE-2019-0333 | Medium | 6.5 | 2019-08-14 | In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can… |
CVE-2019-0332 | Medium | 6.1 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and i… |
CVE-2019-0331 | Medium | 5.3 | 2019-08-14 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive dat… |
CVE-2019-0330 | Critical | 9.1 | 2019-07-10 | The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject cod… |
CVE-2019-0329 | Medium | 6.1 | 2019-07-10 | SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2019-0328 | High | 7.2 | 2019-07-10 | ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wi… |
CVE-2019-0327 | High | 7.2 | 2019-07-10 | SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7… |
CVE-2019-0326 | Medium | 6.1 | 2019-07-10 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, re… |
CVE-2019-0325 | Medium | 4.2 | 2019-07-10 | SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due t… |
CVE-2019-0322 | High | 7.5 | 2019-07-10 | SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate… |
CVE-2019-0321 | Medium | 6.1 | 2019-07-10 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)… |
CVE-2019-0319 | High | 7.5 | 2019-07-10 | The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could… |
CVE-2019-0318 | Medium | 5.3 | 2019-07-10 | Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access… |
CVE-2019-0281 | Medium | 6.1 | 2019-07-10 | SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… |
CVE-2019-0316 | Medium | 4.8 | 2019-06-14 | SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled… |
CVE-2019-0303 | Medium | 6.1 | 2019-06-14 | SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter… |
CVE-2019-0315 | High | 7.5 | 2019-06-12 | Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.5… |
CVE-2019-0314 | Medium | 5.5 | 2019-06-12 | SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, eith… |
CVE-2019-0312 | Medium | 5.3 | 2019-06-12 | Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.3… |
CVE-2019-0311 | Medium | 6.1 | 2019-06-12 | Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inpu… |
CVE-2019-0308 | Medium | 6.8 | 2019-06-12 | An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to ze… |
CVE-2019-0307 | Low | 2.4 | 2019-06-12 | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secu… |
CVE-2019-0306 | Medium | 4.3 | 2019-06-12 | SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to exe… |
CVE-2019-0305 | Medium | 4.3 | 2019-06-12 | Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restri… |
CVE-2019-0304 | Critical | 9.8 | 2019-06-12 | FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EX… |
CVE-2019-0301 | High | 8.8 | 2019-05-14 | Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2… |
CVE-2019-0298 | Medium | 6.1 | 2019-05-14 | SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. F… |
CVE-2019-0293 | Medium | 6.5 | 2019-05-14 | Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations… |
CVE-2019-0291 | Medium | 5.5 | 2019-05-14 | Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0289 | High | 7.1 | 2019-05-14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information… |
CVE-2019-0287 | High | 7.6 | 2019-05-14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access inf… |
CVE-2019-0280 | High | 8.8 | 2019-05-14 | SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary aut… |
CVE-2019-0285 | Critical | 9.8 | 2019-04-10 | The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials whi… |
CVE-2019-0284 | Medium | 6.0 | 2019-04-10 | SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can ca… |
CVE-2019-0283 | High | 7.1 | 2019-04-10 | SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is… |
CVE-2019-0282 | Medium | 5.3 | 2019-04-10 | Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without use… |
CVE-2019-0279 | High | 8.8 | 2019-04-10 | ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.1… |
CVE-2019-0278 | Medium | 4.3 | 2019-04-10 | Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31… |
CVE-2019-0277 | Medium | 6.5 | 2019-03-12 | SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privil… |
CVE-2019-0276 | High | 8.8 | 2019-03-12 | Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check fo… |
CVE-2019-0275 | Medium | 5.4 | 2019-03-12 | SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficient… |
CVE-2019-0274 | High | 7.5 | 2019-03-12 | SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of ser… |
CVE-2019-0271 | Medium | 6.5 | 2019-03-12 | ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an… |
CVE-2019-0270 | High | 8.8 | 2019-03-12 | ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges… |
CVE-2019-0269 | Medium | 5.4 | 2019-03-12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cr… |
CVE-2019-0268 | High | 8.1 | 2019-03-12 | SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an… |
CVE-2019-0267 | High | 8.8 | 2019-02-15 | SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lea… |
CVE-2019-0266 | High | 7.5 | 2019-02-15 | Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file… |
CVE-2019-0265 | Medium | 4.9 | 2019-02-15 | SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in… |
CVE-2019-0262 | Medium | 5.4 | 2019-02-15 | SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Sc… |
CVE-2019-0261 | Critical | 9.8 | 2019-02-15 | Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanc… |