SAP
Page 11 of 16 — SAP CVEs from a corpus of 1582, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0331 | Medium | 5.3 | 2019-08-14 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive dat… |
CVE-2019-0330 | Critical | 9.1 | 2019-07-10 | The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject cod… |
CVE-2019-0329 | Medium | 6.1 | 2019-07-10 | SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2019-0328 | High | 7.2 | 2019-07-10 | ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wi… |
CVE-2019-0327 | High | 7.2 | 2019-07-10 | SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7… |
CVE-2019-0326 | Medium | 6.1 | 2019-07-10 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, re… |
CVE-2019-0325 | Medium | 4.2 | 2019-07-10 | SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due t… |
CVE-2019-0322 | High | 7.5 | 2019-07-10 | SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate… |
CVE-2019-0321 | Medium | 6.1 | 2019-07-10 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)… |
CVE-2019-0319 | High | 7.5 | 2019-07-10 | The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could… |
CVE-2019-0318 | Medium | 5.3 | 2019-07-10 | Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access… |
CVE-2019-0281 | Medium | 6.1 | 2019-07-10 | SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… |
CVE-2019-0316 | Medium | 4.8 | 2019-06-14 | SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled… |
CVE-2019-0303 | Medium | 6.1 | 2019-06-14 | SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter… |
CVE-2019-0315 | High | 7.5 | 2019-06-12 | Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.5… |
CVE-2019-0314 | Medium | 5.5 | 2019-06-12 | SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, eith… |
CVE-2019-0312 | Medium | 5.3 | 2019-06-12 | Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.3… |
CVE-2019-0311 | Medium | 6.1 | 2019-06-12 | Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inpu… |
CVE-2019-0308 | Medium | 6.8 | 2019-06-12 | An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to ze… |
CVE-2019-0307 | Low | 2.4 | 2019-06-12 | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secu… |
CVE-2019-0306 | Medium | 4.3 | 2019-06-12 | SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to exe… |
CVE-2019-0305 | Medium | 4.3 | 2019-06-12 | Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restri… |
CVE-2019-0304 | Critical | 9.8 | 2019-06-12 | FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EX… |
CVE-2019-0301 | High | 8.8 | 2019-05-14 | Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2… |
CVE-2019-0298 | Medium | 6.1 | 2019-05-14 | SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. F… |
CVE-2019-0293 | Medium | 6.5 | 2019-05-14 | Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations… |
CVE-2019-0291 | Medium | 5.5 | 2019-05-14 | Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0289 | High | 7.1 | 2019-05-14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information… |
CVE-2019-0287 | High | 7.6 | 2019-05-14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access inf… |
CVE-2019-0280 | High | 8.8 | 2019-05-14 | SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary aut… |
CVE-2019-0285 | Critical | 9.8 | 2019-04-10 | The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials whi… |
CVE-2019-0284 | Medium | 6.0 | 2019-04-10 | SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can ca… |
CVE-2019-0283 | High | 7.1 | 2019-04-10 | SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is… |
CVE-2019-0282 | Medium | 5.3 | 2019-04-10 | Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without use… |
CVE-2019-0279 | High | 8.8 | 2019-04-10 | ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.1… |
CVE-2019-0278 | Medium | 4.3 | 2019-04-10 | Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31… |
CVE-2019-0277 | Medium | 6.5 | 2019-03-12 | SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privil… |
CVE-2019-0276 | High | 8.8 | 2019-03-12 | Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check fo… |
CVE-2019-0275 | Medium | 5.4 | 2019-03-12 | SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficient… |
CVE-2019-0274 | High | 7.5 | 2019-03-12 | SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of ser… |
CVE-2019-0271 | Medium | 6.5 | 2019-03-12 | ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an… |
CVE-2019-0270 | High | 8.8 | 2019-03-12 | ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges… |
CVE-2019-0269 | Medium | 5.4 | 2019-03-12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cr… |
CVE-2019-0268 | High | 8.1 | 2019-03-12 | SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an… |
CVE-2019-0267 | High | 8.8 | 2019-02-15 | SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lea… |
CVE-2019-0266 | High | 7.5 | 2019-02-15 | Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file… |
CVE-2019-0265 | Medium | 4.9 | 2019-02-15 | SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in… |
CVE-2019-0262 | Medium | 5.4 | 2019-02-15 | SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Sc… |
CVE-2019-0261 | Critical | 9.8 | 2019-02-15 | Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanc… |
CVE-2019-0259 | Critical | 9.8 | 2019-02-15 | SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format valida… |
CVE-2019-0258 | High | 8.8 | 2019-02-15 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2019-0257 | High | 8.8 | 2019-02-15 | Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7… |
CVE-2019-0256 | Medium | 5.5 | 2019-02-15 | Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0255 | High | 8.1 | 2019-02-15 | SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system… |
CVE-2019-0254 | Medium | 5.4 | 2019-02-15 | SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnera… |
CVE-2019-0251 | Medium | 6.1 | 2019-02-15 | The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting… |
CVE-2019-0249 | High | 7.5 | 2019-01-08 | Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0248 | Medium | 5.9 | 2019-01-08 | Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access informat… |
CVE-2019-0247 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the be… |
CVE-2019-0246 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. |
CVE-2019-0245 | Medium | 5.4 | 2019-01-08 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resul… |
CVE-2019-0244 | Medium | 5.4 | 2019-01-08 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resul… |
CVE-2019-0243 | High | 8.8 | 2019-01-08 | Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an a… |
CVE-2019-0241 | High | 7.5 | 2019-01-08 | SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or f… |
CVE-2019-0240 | High | 7.5 | 2019-01-08 | SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legit… |
CVE-2019-0238 | Medium | 6.1 | 2019-01-08 | SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Script… |
CVE-2018-2499 | High | 7.5 | 2019-01-08 | A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash o… |
CVE-2018-2484 | High | 8.8 | 2019-01-08 | SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6… |
CVE-2018-2505 | Medium | 6.1 | 2018-12-11 | SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the… |
CVE-2018-2504 | Medium | 6.1 | 2018-12-11 | SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross… |
CVE-2018-2503 | High | 7.4 | 2018-12-11 | By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in… |
CVE-2018-2502 | Medium | 6.1 | 2018-12-11 | TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service La… |
CVE-2018-2500 | Medium | 4.7 | 2018-12-11 | Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to access information which would otherwis… |
CVE-2018-2497 | Low | 2.7 | 2018-12-11 | The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <tabl… |
CVE-2018-2494 | High | 8.0 | 2018-12-11 | Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 7… |
CVE-2018-2492 | High | 7.1 | 2018-12-11 | SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2… |
CVE-2018-2486 | Medium | 5.4 | 2018-12-11 | SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) v… |
CVE-2018-2491 | High | 7.8 | 2018-11-13 | When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malic… |
CVE-2018-2490 | High | 7.8 | 2018-11-13 | The broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori Client version 1.11.5 in Google Play store addresses these issu… |
CVE-2018-2489 | High | 7.8 | 2018-11-13 | Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Go… |
CVE-2018-2488 | High | 7.8 | 2018-11-13 | It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori Client and cause th… |
CVE-2018-2487 | High | 8.3 | 2018-11-13 | SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in specific use cases, file… |
CVE-2018-2485 | High | 7.7 | 2018-11-13 | It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and… |
CVE-2018-2483 | Medium | 4.3 | 2018-11-13 | HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing reque… |
CVE-2018-2482 | High | 7.5 | 2018-11-13 | SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimate users from acces… |
CVE-2018-2481 | High | 7.2 | 2018-11-13 | In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is us… |
CVE-2018-2479 | Medium | 6.1 | 2018-11-13 | SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross… |
CVE-2018-2478 | High | 7.2 | 2018-11-13 | An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30… |
CVE-2018-2477 | High | 8.8 | 2018-11-13 | Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted… |
CVE-2018-2476 | Medium | 6.1 | 2018-11-13 | Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site. |
CVE-2018-2473 | Medium | 6.5 | 2018-11-13 | SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker… |
CVE-2018-2475 | High | 8.5 | 2018-10-09 | Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing net… |
CVE-2018-2474 | Medium | 6.5 | 2018-10-09 | SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to th… |
CVE-2018-2472 | Medium | 6.1 | 2018-10-09 | SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 (Web Intelligence DHTML client) does not sufficiently encode user-controlled inputs, resulting… |
CVE-2018-2471 | High | 7.5 | 2018-10-09 | Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 allows an attacker to access information which would otherwise be res… |
CVE-2018-2470 | Medium | 6.1 | 2018-10-09 | In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled… |
CVE-2018-2469 | High | 7.5 | 2018-10-09 | Under certain conditions SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which would otherwise be restri… |
CVE-2018-2468 | High | 7.5 | 2018-10-09 | Under certain conditions the backup server in SAP Adaptive Server Enterprise (ASE), versions 15.7 and 16.0, allows an attacker to access information which woul… |
CVE-2018-2467 | Medium | 5.3 | 2018-10-09 | In the Software Development Kit in SAP BusinessObjects BI Platform Servers, versions 4.1 and 4.2, using the specially crafted URL in a Web Browser such as Chro… |
CVE-2018-2466 | Medium | 5.4 | 2018-10-09 | In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results i… |