SAP
Page 6 of 16 — SAP CVEs from a corpus of 1582, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22544 | Critical | 9.1 | 2022-02-09 | Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse… |
CVE-2022-22543 | High | 7.5 | 2022-02-09 | SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC… |
CVE-2022-22542 | Medium | 6.5 | 2022-02-09 | S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer… |
CVE-2022-22540 | High | 7.5 | 2022-02-09 | SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted data… |
CVE-2022-22539 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-22538 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, t… |
CVE-2022-22537 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the… |
CVE-2022-22536 | Critical | 10.0 | 2022-02-09 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for… |
CVE-2022-22535 | Medium | 6.5 | 2022-02-09 | SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certa… |
CVE-2022-22534 | Medium | 6.1 | 2022-02-09 | Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and pas… |
CVE-2022-22533 | High | 7.5 | 2022-02-09 | Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7… |
CVE-2022-22532 | Critical | 9.8 | 2022-02-09 | In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthentic… |
CVE-2022-22528 | High | 7.8 | 2022-02-09 | SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certa… |
CVE-2022-22531 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22530 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22529 | Medium | 6.1 | 2022-01-14 | SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly ex… |
CVE-2021-44234 | Medium | 5.5 | 2022-01-14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitiv… |
CVE-2021-42067 | Medium | 4.3 | 2022-01-14 | In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a… |
CVE-2021-44235 | Medium | 6.7 | 2021-12-14 | Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker… |
CVE-2021-44233 | High | 8.8 | 2021-12-14 | SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead… |
CVE-2021-44232 | High | 7.7 | 2021-12-14 | SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server d… |
CVE-2021-44231 | Critical | 9.8 | 2021-12-14 | Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavio… |
CVE-2021-42070 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application… |
CVE-2021-42069 | Low | 3.3 | 2021-12-14 | When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic… |
CVE-2021-42068 | Low | 3.3 | 2021-12-14 | When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and b… |
CVE-2021-42066 | Medium | 4.4 | 2021-12-14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker… |
CVE-2021-42064 | Critical | 9.8 | 2021-12-14 | If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions… |
CVE-2021-42063 | Medium | 6.1 | 2021-12-14 | A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web b… |
CVE-2021-42061 | Medium | 5.4 | 2021-12-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2021-42062 | Medium | 4.3 | 2021-11-10 | SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affecte… |
CVE-2021-40504 | Medium | 4.9 | 2021-11-10 | A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 7… |
CVE-2021-40503 | High | 7.8 | 2021-11-10 | An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on… |
CVE-2021-40502 | High | 8.8 | 2021-11-10 | SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation o… |
CVE-2021-40501 | High | 8.1 | 2021-11-10 | SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in es… |
CVE-2021-41251 | Medium | 5.9 | 2021-11-05 | @sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects application… |
CVE-2021-40500 | High | 7.5 | 2021-10-12 | SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations… |
CVE-2021-40499 | Critical | 9.8 | 2021-10-12 | Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an… |
CVE-2021-40498 | Medium | 5.5 | 2021-10-12 | A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legiti… |
CVE-2021-40497 | Medium | 5.3 | 2021-10-12 | SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sensitive data. These… |
CVE-2021-40496 | Medium | 4.3 | 2021-10-12 | SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon funct… |
CVE-2021-40495 | Medium | 5.3 | 2021-10-12 | There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 75… |
CVE-2021-38183 | Medium | 6.1 | 2021-10-12 | SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a… |
CVE-2021-38181 | High | 7.5 | 2021-10-12 | SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate us… |
CVE-2021-38180 | Critical | 9.8 | 2021-10-12 | SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data… |
CVE-2021-38179 | Medium | 4.9 | 2021-10-12 | Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include… |
CVE-2021-38178 | High | 8.8 | 2021-10-12 | The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enabl… |
CVE-2021-33705 | High | 8.1 | 2021-09-15 | The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerabil… |
CVE-2021-33704 | High | 8.8 | 2021-09-15 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to speci… |
CVE-2021-33701 | Critical | 9.1 | 2021-09-15 | DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCOR… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2021-33698 | High | 8.8 | 2021-09-15 | SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format va… |
CVE-2021-33697 | Medium | 6.1 | 2021-09-15 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attacker to redirect u… |
CVE-2021-33696 | Medium | 5.4 | 2021-09-15 | SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputs and therefore an… |
CVE-2021-33695 | Critical | 9.1 | 2021-09-15 | Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate. |
CVE-2021-33694 | Medium | 4.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious c… |
CVE-2021-33693 | Medium | 6.8 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead… |
CVE-2021-33692 | High | 7.5 | 2021-09-15 | SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' s… |
CVE-2021-33691 | Medium | 6.1 | 2021-09-15 | NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabili… |
CVE-2021-33690 | Critical | 9.9 | 2021-09-15 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.2… |
CVE-2021-38177 | High | 7.5 | 2021-09-14 | SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends crafted malicious da… |
CVE-2021-38176 | High | 8.8 | 2021-09-14 | Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section t… |
CVE-2021-38175 | Medium | 6.5 | 2021-09-14 | SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change informat… |
CVE-2021-38174 | Medium | 6.5 | 2021-09-14 | When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes tempora… |
CVE-2021-38164 | Medium | 5.4 | 2021-09-14 | SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAPSCORE - 125, S4C… |
CVE-2021-38163 | Critical | 9.9 | 2021-09-14 | SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can uploa… |
CVE-2021-38162 | High | 8.9 | 2021-09-14 | SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7… |
CVE-2021-38150 | Medium | 6.5 | 2021-09-14 | When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client ver… |
CVE-2021-37535 | Critical | 9.8 | 2021-09-14 | SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks fo… |
CVE-2021-37532 | Medium | 4.3 | 2021-09-14 | SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the… |
CVE-2021-37531 | High | 8.8 | 2021-09-14 | SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative au… |
CVE-2021-33688 | Medium | 4.3 | 2021-09-14 | SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions… |
CVE-2021-33686 | Medium | 5.3 | 2021-09-14 | Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not… |
CVE-2021-33685 | Medium | 6.5 | 2021-09-14 | SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restric… |
CVE-2021-33679 | Medium | 5.4 | 2021-09-14 | The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script while creating a ne… |
CVE-2021-33675 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected… |
CVE-2021-33674 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected… |
CVE-2021-33673 | Medium | 6.1 | 2021-09-14 | Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to… |
CVE-2021-33672 | Critical | 9.6 | 2021-09-14 | Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the… |
CVE-2021-21489 | Medium | 4.8 | 2021-09-14 | SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-… |
CVE-2021-33707 | Medium | 6.1 | 2021-08-10 | SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component… |
CVE-2021-33706 | Medium | 4.3 | 2021-08-10 | Due to improper input validation in InfraBox, logs can be modified by an authenticated user. |
CVE-2021-33703 | Medium | 6.1 | 2021-08-10 | Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a… |
CVE-2021-33702 | Medium | 6.1 | 2021-08-10 | Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attack… |
CVE-2021-33699 | Medium | 6.5 | 2021-08-10 | Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Ta… |
CVE-2018-17865 | Medium | 6.1 | 2021-08-09 | A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcpro… |
CVE-2018-17862 | Medium | 6.1 | 2021-08-09 | A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys_jdbc parameter to /… |
CVE-2018-17861 | Medium | 6.1 | 2021-08-09 | A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the wsdlLib parameter… |
CVE-2015-7731 | Medium | 5.5 | 2021-08-09 | SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 209483… |
CVE-2015-2074 | High | 7.5 | 2021-08-09 | The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka S… |
CVE-2015-2073 | High | 7.5 | 2021-08-09 | The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full pathname, aka SAP N… |
CVE-2014-9320 | Critical | 9.8 | 2021-08-09 | SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vect… |
CVE-2021-33689 | Medium | 4.3 | 2021-07-14 | When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security… |
CVE-2021-33687 | Medium | 4.9 | 2021-07-14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attack… |
CVE-2021-33684 | Medium | 5.3 | 2021-07-14 | SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.2… |
CVE-2021-33683 | Medium | 4.3 | 2021-07-14 | SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NU… |
CVE-2021-33682 | Medium | 5.4 | 2021-07-14 | SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This would allow an a… |
CVE-2021-33681 | Medium | 6.5 | 2021-07-14 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and c… |
CVE-2021-33680 | Medium | 6.5 | 2021-07-14 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and cause… |
CVE-2021-33678 | Medium | 6.5 | 2021-07-14 | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75… |
CVE-2021-33677 | High | 7.5 | 2021-07-14 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information disc… |