Sap
Page 4 of 7 — Sap CVEs from a corpus of 608, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-24528 | Medium | 6.5 | 2023-02-14 | SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured applic… |
CVE-2023-24525 | Medium | 4.3 | 2023-02-14 | SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (… |
CVE-2023-24524 | Medium | 6.5 | 2023-02-14 | SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privi… |
CVE-2023-24523 | High | 8.8 | 2023-02-14 | An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can subm… |
CVE-2023-24522 | Medium | 6.1 | 2023-02-14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alt… |
CVE-2023-24521 | Medium | 6.1 | 2023-02-14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow… |
CVE-2023-23860 | Medium | 6.1 | 2023-02-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a lin… |
CVE-2023-23859 | Medium | 6.1 | 2023-02-14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a mal… |
CVE-2023-23858 | Medium | 6.1 | 2023-02-14 | Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an u… |
CVE-2023-23856 | Medium | 4.3 | 2023-02-14 | In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content type in the header of t… |
CVE-2023-23855 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful att… |
CVE-2023-23854 | Low | 3.8 | 2023-02-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks… |
CVE-2023-23853 | Medium | 6.1 | 2023-02-14 | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757… |
CVE-2023-23852 | Medium | 6.1 | 2023-02-14 | SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabil… |
CVE-2023-23851 | Medium | 5.4 | 2023-02-14 | SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload any files (including web pages) without t… |
CVE-2023-0025 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, c… |
CVE-2023-0024 | Medium | 6.5 | 2023-02-14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, c… |
CVE-2023-0020 | High | 8.5 | 2023-02-14 | SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise res… |
CVE-2023-0019 | Medium | 6.5 | 2023-02-14 | In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module… |
CVE-2023-0023 | Medium | 4.5 | 2023-01-10 | In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the U… |
CVE-2023-0022 | Critical | 9.9 | 2023-01-10 | SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the appli… |
CVE-2023-0018 | Critical | 10.0 | 2023-01-10 | Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an a… |
CVE-2023-0017 | Critical | 9.4 | 2023-01-10 | An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an ope… |
CVE-2023-0016 | Critical | 9.9 | 2023-01-10 | SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection… |
CVE-2023-0015 | Medium | 4.6 | 2023-01-10 | In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the he… |
CVE-2023-0014 | Critical | 9.0 | 2023-01-10 | SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7… |
CVE-2023-0013 | Medium | 6.1 | 2023-01-10 | The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform… |
CVE-2023-0012 | Medium | 6.4 | 2023-01-10 | In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicio… |
CVE-2022-41275 | Medium | 6.1 | 2022-12-13 | In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can… |
CVE-2022-41274 | Medium | 6.5 | 2022-12-13 | SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These… |
CVE-2022-41273 | Medium | 4.3 | 2022-12-13 | Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website… |
CVE-2022-41272 | Critical | 9.9 | 2022-12-13 | An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Int… |
CVE-2022-41271 | Critical | 9.4 | 2022-12-13 | An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50… |
CVE-2022-41268 | High | 8.5 | 2022-12-13 | In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, … |
CVE-2022-41267 | Critical | 9.9 | 2022-12-13 | SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server… |
CVE-2022-41266 | High | 8.0 | 2022-12-13 | Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untru… |
CVE-2022-41264 | High | 8.8 | 2022-12-13 | Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authe… |
CVE-2022-41263 | Medium | 4.3 | 2022-12-12 | Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an authenticated non-… |
CVE-2022-41262 | Medium | 6.1 | 2022-12-12 | Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into… |
CVE-2022-41261 | Medium | 6.0 | 2022-12-12 | SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can… |
CVE-2022-31596 | Medium | 6.0 | 2022-12-12 | Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intel… |
CVE-2022-41260 | Medium | 6.1 | 2022-11-08 | SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web scri… |
CVE-2022-41259 | Medium | 6.5 | 2022-11-08 | SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the ser… |
CVE-2022-41258 | Medium | 6.5 | 2022-11-08 | Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a co… |
CVE-2022-41215 | Medium | 4.7 | 2022-11-08 | SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This c… |
CVE-2022-41214 | High | 8.7 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-41212 | Medium | 4.9 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-41211 | High | 7.0 | 2022-11-08 | Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Vis… |
CVE-2022-41208 | Medium | 5.4 | 2022-11-08 | Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user s… |
CVE-2022-41207 | Medium | 6.1 | 2022-11-08 | SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized par… |
CVE-2022-41205 | Medium | 5.5 | 2022-11-08 | SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which… |
CVE-2022-41203 | High | 8.8 | 2022-11-08 | In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept… |
CVE-2022-41210 | Medium | 5.2 | 2022-10-11 | SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to pre… |
CVE-2022-41209 | Medium | 5.2 | 2022-10-11 | SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well… |
CVE-2022-41206 | Medium | 5.4 | 2022-10-11 | SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs whe… |
CVE-2022-41204 | High | 8.8 | 2022-10-11 | An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that… |
CVE-2022-41202 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D… |
CVE-2022-41201 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D… |
CVE-2022-41200 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusted sources in SAP… |
CVE-2022-41199 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sources in SAP 3D Vi… |
CVE-2022-41198 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual… |
CVE-2022-41197 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual E… |
CVE-2022-41196 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual E… |
CVE-2022-41195 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received from untrusted sources… |
CVE-2022-41194 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrusted sources in SAP 3… |
CVE-2022-41193 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrusted sources in SAP… |
CVE-2022-41192 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D… |
CVE-2022-41191 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP… |
CVE-2022-41190 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41189 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41188 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP… |
CVE-2022-41187 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in S… |
CVE-2022-41186 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in… |
CVE-2022-41185 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, MataiPersistence.dll) file received from untrusted sourc… |
CVE-2022-41184 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted sources in SAP 3D V… |
CVE-2022-41183 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted sources in SAP 3D Vis… |
CVE-2022-41182 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Parasolid Part and Assembly (.x_b, CoreCadTranslator.exe) file received from untrusted… |
CVE-2022-41181 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted source… |
CVE-2022-41180 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sour… |
CVE-2022-41179 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JtTranslator.exe) file received from untrusted sources in… |
CVE-2022-41178 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file received from untrust… |
CVE-2022-41177 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file received from untru… |
CVE-2022-41176 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted sources in SAP 3D Visua… |
CVE-2022-41175 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted sources in SAP 3D Vis… |
CVE-2022-41174 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Right Hemisphere Material (.rhm, rh.x3d) file received from untrusted sources in SAP 3… |
CVE-2022-41173 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D Vi… |
CVE-2022-41172 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41171 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrusted sources in SAP… |
CVE-2022-41170 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrusted sources in SA… |
CVE-2022-41169 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from untrusted sources in SA… |
CVE-2022-41168 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from untrusted sources in… |
CVE-2022-41167 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41166 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP… |
CVE-2022-39808 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in S… |
CVE-2022-39807 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated SolidWorks Drawing (.sldasm, CoreCadTranslator.exe) file received from untrusted sourc… |
CVE-2022-39806 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Drawing (.slddrw, CoreCadTranslator.exe) file received from untrusted sou… |
CVE-2022-39805 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Computer Graphics Metafile (.cgm, CgmTranslator.exe) file received from untrusted so… |
CVE-2022-39804 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Part (.sldprt, CoreCadTranslator.exe) file received from untrusted source… |
CVE-2022-39803 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated ACIS Part and Assembly (.sat, CoreCadTranslator.exe) file received from untrusted so… |
CVE-2022-39802 | High | 7.5 | 2022-10-11 | SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameter. The intended f… |