SAP
Page 10 of 16 — SAP CVEs from a corpus of 1582, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6223 | Medium | 6.1 | 2020-04-14 | The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malici… |
CVE-2020-6222 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2020-6221 | Medium | 5.4 | 2020-04-14 | Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2020-6219 | High | 8.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta… |
CVE-2020-6218 | Medium | 5.0 | 2020-04-14 | Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should o… |
CVE-2020-6216 | Medium | 6.1 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cr… |
CVE-2020-6214 | Medium | 4.7 | 2020-04-14 | SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected wi… |
CVE-2020-6210 | Medium | 6.1 | 2020-03-10 | SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the l… |
CVE-2020-6209 | High | 7.5 | 2020-03-10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts… |
CVE-2020-6208 | High | 8.2 | 2020-03-10 | SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can… |
CVE-2020-6207 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin… |
CVE-2020-6206 | Medium | 4.3 | 2020-03-10 | SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim t… |
CVE-2020-6205 | Medium | 6.1 | 2020-03-10 | SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; do… |
CVE-2020-6204 | Medium | 4.3 | 2020-03-10 | The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE ve… |
CVE-2020-6203 | Critical | 9.1 | 2020-03-10 | SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of pat… |
CVE-2020-6202 | High | 7.2 | 2020-03-10 | SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP dat… |
CVE-2020-6201 | Medium | 6.1 | 2020-03-10 | The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL p… |
CVE-2020-6200 | Medium | 5.4 | 2020-03-10 | The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scri… |
CVE-2020-6199 | Medium | 5.4 | 2020-03-10 | The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Managemen… |
CVE-2020-6198 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo… |
CVE-2020-6197 | Low | 3.3 | 2020-03-10 | SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local… |
CVE-2020-6196 | High | 7.5 | 2020-03-10 | SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting… |
CVE-2020-6178 | Medium | 5.4 | 2020-03-10 | SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Informati… |
CVE-2015-7968 | Medium | 4.3 | 2020-03-09 | nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/… |
CVE-2020-6193 | Medium | 6.1 | 2020-02-12 | SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to R… |
CVE-2020-6192 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP La… |
CVE-2020-6191 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP… |
CVE-2020-6190 | Medium | 5.8 | 2020-02-12 | Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system l… |
CVE-2020-6189 | Medium | 5.3 | 2020-02-12 | Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-n… |
CVE-2020-6188 | High | 8.8 | 2020-02-12 | VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 1… |
CVE-2020-6187 | Medium | 4.9 | 2020-02-12 | SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised a… |
CVE-2020-6186 | High | 7.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, le… |
CVE-2020-6185 | Medium | 5.4 | 2020-02-12 | Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), all… |
CVE-2020-6184 | Medium | 6.1 | 2020-02-12 | Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), do… |
CVE-2020-6183 | Medium | 6.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL proce… |
CVE-2020-6181 | Medium | 5.8 | 2020-02-12 | Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750… |
CVE-2020-6177 | Medium | 4.3 | 2020-02-12 | SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of servic… |
CVE-2011-1517 | Critical | 9.8 | 2020-02-05 | SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet… |
CVE-2013-1593 | High | 7.5 | 2020-01-23 | A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when s… |
CVE-2013-1592 | Critical | 9.8 | 2020-01-23 | A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets… |
CVE-2020-6307 | Medium | 4.3 | 2020-01-14 | Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization… |
CVE-2020-6306 | Low | 2.7 | 2020-01-14 | Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). |
CVE-2020-6305 | Medium | 6.1 | 2020-01-14 | PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cro… |
CVE-2020-6304 | High | 7.5 | 2020-01-14 | Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRN… |
CVE-2020-6303 | Medium | 5.4 | 2020-01-14 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. |
CVE-2019-0384 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0383 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0405 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a us… |
CVE-2019-0404 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure. |
CVE-2019-0403 | Critical | 9.8 | 2019-12-11 | SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Inject… |
CVE-2019-0402 | Medium | 4.4 | 2019-12-11 | SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information… |
CVE-2019-0399 | Medium | 6.5 | 2019-12-11 | SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discove… |
CVE-2019-0398 | High | 8.8 | 2019-12-11 | Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to… |
CVE-2019-0395 | Medium | 5.4 | 2019-12-11 | SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launch… |
CVE-2019-0396 | High | 7.1 | 2019-11-13 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML… |
CVE-2019-0388 | Medium | 5.3 | 2019-11-13 | SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insu… |
CVE-2019-0386 | Medium | 6.3 | 2019-11-13 | Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01… |
CVE-2019-0393 | Medium | 4.3 | 2019-11-13 | An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database… |
CVE-2019-0391 | Medium | 4.3 | 2019-11-13 | Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise… |
CVE-2019-0390 | Medium | 4.3 | 2019-11-13 | Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted. Conn… |
CVE-2019-0389 | High | 8.8 | 2019-11-13 | An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for al… |
CVE-2019-0385 | Medium | 6.5 | 2019-11-13 | SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2019-0382 | Medium | 5.4 | 2019-11-13 | A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in ve… |
CVE-2019-0350 | High | 7.5 | 2019-11-04 | SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA inst… |
CVE-2019-0381 | Medium | 5.5 | 2019-10-08 | A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the i… |
CVE-2019-0380 | Medium | 4.9 | 2019-10-08 | Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the ap… |
CVE-2019-0379 | Medium | 5.3 | 2019-10-08 | SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is c… |
CVE-2019-0378 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs a… |
CVE-2019-0377 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2019-0376 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled… |
CVE-2019-0375 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled… |
CVE-2019-0374 | Medium | 5.4 | 2019-10-08 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled… |
CVE-2019-0370 | Medium | 6.5 | 2019-10-08 | Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the str… |
CVE-2019-0369 | Medium | 5.4 | 2019-10-08 | SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by… |
CVE-2019-0368 | Medium | 5.4 | 2019-10-08 | SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not suffi… |
CVE-2019-0367 | Medium | 4.3 | 2019-10-08 | SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowi… |
CVE-2019-0365 | High | 7.5 | 2019-09-10 | SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49… |
CVE-2019-0364 | Medium | 4.3 | 2019-09-10 | Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports. |
CVE-2019-0363 | High | 7.1 | 2019-09-10 | Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrie… |
CVE-2019-0361 | Medium | 6.1 | 2019-09-10 | SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-control… |
CVE-2019-0357 | Medium | 6.7 | 2019-09-10 | The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges. |
CVE-2019-0356 | Medium | 4.3 | 2019-09-10 | Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to… |
CVE-2019-0355 | High | 7.2 | 2019-09-10 | SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0… |
CVE-2019-0353 | Low | 3.3 | 2019-09-10 | Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would othe… |
CVE-2019-0352 | High | 7.5 | 2019-09-10 | In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker… |
CVE-2019-0349 | High | 7.2 | 2019-08-14 | SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.4… |
CVE-2019-0351 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this… |
CVE-2019-0348 | Medium | 6.5 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality… |
CVE-2019-0346 | Medium | 6.5 | 2019-08-14 | Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list o… |
CVE-2019-0345 | Critical | 9.8 | 2019-08-14 | A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7… |
CVE-2019-0344 | Critical | 9.8 | 2019-08-14 | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbi… |
CVE-2019-0343 | High | 8.8 | 2019-08-14 | SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that… |
CVE-2019-0341 | High | 8.8 | 2019-08-14 | The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application… |
CVE-2019-0340 | Medium | 5.4 | 2019-08-14 | The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. T… |
CVE-2019-0338 | Medium | 5.3 | 2019-08-14 | During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing… |
CVE-2019-0337 | Medium | 6.1 | 2019-08-14 | Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and a… |
CVE-2019-0335 | Medium | 6.1 | 2019-08-14 | Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a… |
CVE-2019-0334 | Medium | 5.4 | 2019-08-14 | When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script… |
CVE-2019-0333 | Medium | 6.5 | 2019-08-14 | In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can… |
CVE-2019-0332 | Medium | 6.1 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and i… |