SAP SE
Page 8 of 8 — SAP SE CVEs from a corpus of 778, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0259 | Critical | 9.8 | 2019-02-15 | SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format valida… |
CVE-2019-0258 | High | 8.8 | 2019-02-15 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2019-0257 | High | 8.8 | 2019-02-15 | Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7… |
CVE-2019-0256 | Medium | 5.5 | 2019-02-15 | Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0254 | Medium | 5.4 | 2019-02-15 | SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnera… |
CVE-2019-0251 | Medium | 6.1 | 2019-02-15 | The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting… |
CVE-2019-0249 | High | 7.5 | 2019-01-08 | Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0248 | Medium | 5.9 | 2019-01-08 | Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access informat… |
CVE-2019-0247 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the be… |
CVE-2019-0246 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. |
CVE-2019-0245 | Medium | 5.4 | 2019-01-08 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resul… |
CVE-2019-0244 | Medium | 5.4 | 2019-01-08 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resul… |
CVE-2019-0243 | High | 8.8 | 2019-01-08 | Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an a… |
CVE-2019-0241 | High | 7.5 | 2019-01-08 | SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or f… |
CVE-2019-0240 | High | 7.5 | 2019-01-08 | SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legit… |
CVE-2019-0238 | Medium | 6.1 | 2019-01-08 | SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Script… |
CVE-2018-2499 | High | 7.5 | 2019-01-08 | A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash o… |
CVE-2018-2484 | High | 8.8 | 2019-01-08 | SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6… |
CVE-2018-2428 | Medium | 5.3 | 2018-06-12 | Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP In… |
CVE-2018-2425 | High | 8.4 | 2018-06-12 | Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted. |
CVE-2018-2424 | Critical | 9.8 | 2018-06-12 | SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that… |
CVE-2018-2423 | Medium | 5.3 | 2018-05-09 | SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users from accessing a serv… |
CVE-2018-2422 | Medium | 5.3 | 2018-05-09 | SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, eithe… |
CVE-2018-2421 | Medium | 5.3 | 2018-05-09 | SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, eithe… |
CVE-2018-2420 | Medium | 6.5 | 2018-05-09 | SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format… |
CVE-2018-2419 | Low | 3.7 | 2018-05-09 | SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary autho… |
CVE-2018-2418 | Medium | 5.5 | 2018-05-09 | SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby cont… |
CVE-2018-2417 | Medium | 5.3 | 2018-05-09 | Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted. |
CVE-2018-2415 | Medium | 4.7 | 2018-05-09 | SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30… |
CVE-2018-2413 | Medium | 5.4 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2412 | Low | 3.8 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2410 | Medium | 5.4 | 2018-04-10 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability. |
CVE-2018-2409 | Medium | 6.3 | 2018-04-10 | Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may… |
CVE-2018-2408 | High | 7.3 | 2018-04-10 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a… |
CVE-2018-2406 | Medium | 5.3 | 2018-04-10 | Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path. |
CVE-2018-2405 | Medium | 5.4 | 2018-04-10 | SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possi… |
CVE-2018-2404 | Medium | 4.3 | 2018-04-10 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. |
CVE-2018-2403 | Medium | 5.4 | 2018-04-10 | Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an au… |
CVE-2018-2402 | High | 7.6 | 2018-03-14 | In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), us… |
CVE-2018-2401 | Medium | 5.4 | 2018-03-14 | SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External… |
CVE-2018-2399 | Medium | 6.1 | 2018-03-14 | Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inpu… |
CVE-2018-2398 | High | 7.5 | 2018-03-14 | Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted. |
CVE-2018-2397 | Medium | 5.4 | 2018-03-14 | In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controll… |
CVE-2018-2366 | Medium | 4.3 | 2018-03-14 | SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus c… |
CVE-2018-2380 | Medium | 6.6 | 2018-03-01 | SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters repres… |
CVE-2018-2368 | Critical | 9.8 | 2018-03-01 | SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require use… |
CVE-2018-2367 | High | 8.8 | 2018-03-01 | ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient valida… |
CVE-2018-2365 | Medium | 6.1 | 2018-03-01 | SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vuln… |
CVE-2018-2396 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53… |
CVE-2018-2395 | High | 8.8 | 2018-02-14 | Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, overwrite existing im… |
CVE-2018-2394 | Medium | 6.5 | 2018-02-14 | Under certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7… |
CVE-2018-2393 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-2392 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-2389 | Medium | 5.7 | 2018-02-14 | Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important informa… |
CVE-2018-2388 | Medium | 6.1 | 2018-02-14 | Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. |
CVE-2018-2387 | Medium | 6.5 | 2018-02-14 | A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on ports, which is not… |
CVE-2018-2386 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user provoking an out of bounds buffer overflow can prevent legitimate users from accessing the SAP Internet Graphics Serv… |
CVE-2018-2385 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user provoking a divide by zero crash can prevent legitimate users from accessing the SAP Internet Graphics Server, 7.20… |
CVE-2018-2384 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user provoking a Null Pointer dereference can prevent legitimate users from accessing the SAP Internet Graphics Server, 7… |
CVE-2018-2383 | Medium | 6.1 | 2018-02-14 | Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. |
CVE-2018-2382 | Medium | 6.5 | 2018-02-14 | A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a controlled area and a… |
CVE-2018-2381 | High | 8.8 | 2018-02-14 | SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does no… |
CVE-2018-2379 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endp… |
CVE-2018-2378 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption. |
CVE-2018-2377 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users. |
CVE-2018-2376 | High | 8.1 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environment… |
CVE-2018-2375 | High | 8.1 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environment… |
CVE-2018-2374 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application d… |
CVE-2018-2373 | High | 7.5 | 2018-02-14 | Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver infor… |
CVE-2018-2372 | Medium | 6.5 | 2018-02-14 | A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communica… |
CVE-2018-2371 | Medium | 6.1 | 2018-02-14 | The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site… |
CVE-2018-2370 | Medium | 5.3 | 2018-02-14 | Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, from 4.30, could allo… |
CVE-2018-2369 | Medium | 5.3 | 2018-02-14 | Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can mi… |
CVE-2018-2364 | Medium | 6.1 | 2018-02-14 | SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site… |
CVE-2018-2363 | High | 8.8 | 2018-01-09 | SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program… |
CVE-2018-2362 | Medium | 5.3 | 2018-01-09 | A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such… |
CVE-2018-2361 | High | 8.8 | 2018-01-09 | In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for confi… |
CVE-2018-2360 | High | 7.5 | 2018-01-09 | SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption o… |