SAP
Page 8 of 16 — SAP CVEs from a corpus of 1582, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21467 | Medium | 4.3 | 2021-01-12 | SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An… |
CVE-2021-21466 | High | 8.8 | 2021-01-12 | SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject cod… |
CVE-2021-21465 | Critical | 9.9 | 2021-01-12 | The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can includ… |
CVE-2021-21464 | Medium | 4.3 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21463 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21462 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21461 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21460 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21459 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21458 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21457 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21456 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21455 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21454 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21453 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21452 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21451 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21450 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21449 | High | 8.8 | 2021-01-12 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the appli… |
CVE-2021-21448 | Medium | 6.5 | 2021-01-12 | SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under… |
CVE-2021-21447 | Medium | 5.4 | 2021-01-12 | SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom… |
CVE-2021-21446 | High | 7.5 | 2021-01-12 | SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, eit… |
CVE-2021-21445 | Medium | 5.4 | 2021-01-12 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type hea… |
CVE-2020-26838 | Critical | 9.1 | 2020-12-09 | SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenti… |
CVE-2020-26837 | Critical | 9.1 | 2020-12-09 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing pa… |
CVE-2020-26836 | Medium | 6.1 | 2020-12-09 | SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attack… |
CVE-2020-26835 | Medium | 6.1 | 2020-12-09 | SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in th… |
CVE-2020-26834 | Medium | 5.4 | 2020-12-09 | SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manip… |
CVE-2020-26832 | High | 7.6 | 2020-12-09 | SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA… |
CVE-2020-26831 | Critical | 9.6 | 2020-12-09 | SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crystal report generati… |
CVE-2020-26830 | High | 8.1 | 2020-12-09 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequ… |
CVE-2020-26829 | Critical | 10.0 | 2020-12-09 | SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missin… |
CVE-2020-26828 | Medium | 6.4 | 2020-12-09 | SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types… |
CVE-2020-26826 | Medium | 6.5 | 2020-12-09 | Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without pr… |
CVE-2020-26816 | Medium | 4.5 | 2020-12-09 | SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key S… |
CVE-2020-6317 | Low | 3.5 | 2020-11-30 | In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears… |
CVE-2020-26825 | Medium | 6.1 | 2020-11-13 | SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Applicati… |
CVE-2020-6316 | Medium | 4.3 | 2020-11-10 | SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Autho… |
CVE-2020-26824 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the U… |
CVE-2020-26823 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the U… |
CVE-2020-26822 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the O… |
CVE-2020-26821 | Critical | 10.0 | 2020-11-10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the S… |
CVE-2020-26820 | High | 7.2 | 2020-11-10 | SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, t… |
CVE-2020-26819 | High | 8.8 | 2020-11-10 | SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that… |
CVE-2020-26818 | High | 8.8 | 2020-11-10 | SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which… |
CVE-2020-26817 | High | 7.8 | 2020-11-10 | SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the app… |
CVE-2020-26815 | High | 8.6 | 2020-11-10 | SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web… |
CVE-2020-26814 | Medium | 4.9 | 2020-11-10 | SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Modu… |
CVE-2020-26811 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network… |
CVE-2020-26810 | High | 7.5 | 2020-11-10 | SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network… |
CVE-2020-26809 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence… |
CVE-2020-26808 | High | 7.2 | 2020-11-10 | SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 1… |
CVE-2020-26807 | Low | 3.3 | 2020-11-10 | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone t… |
CVE-2020-6370 | Medium | 4.8 | 2020-10-20 | SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2020-6369 | Medium | 5.9 | 2020-10-20 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the au… |
CVE-2020-6367 | Medium | 6.1 | 2020-10-20 | There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthent… |
CVE-2020-6366 | Medium | 6.5 | 2020-10-20 | SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privi… |
CVE-2020-6362 | Medium | 6.5 | 2020-10-20 | SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthoriza… |
CVE-2020-6315 | Medium | 5.5 | 2020-10-20 | SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of sensitive informati… |
CVE-2020-6308 | Medium | 5.3 | 2020-10-20 | SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CM… |
CVE-2020-6365 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicio… |
CVE-2020-6376 | Medium | 5.5 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted sources which result… |
CVE-2020-6375 | Medium | 5.5 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Computer Graphics Metafile (.cgm) file received from untrusted sources wh… |
CVE-2020-6374 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sources which results in… |
CVE-2020-6373 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6372 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6371 | Medium | 4.3 | 2020-10-15 | User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server… |
CVE-2020-6368 | Medium | 5.4 | 2020-10-15 | SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displaye… |
CVE-2020-6364 | Critical | 10.0 | 2020-10-15 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that… |
CVE-2020-6363 | Medium | 4.6 | 2020-10-15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established afte… |
CVE-2020-6323 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker… |
CVE-2020-6319 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks… |
CVE-2020-6272 | Medium | 5.4 | 2020-10-15 | SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to… |
CVE-2020-6324 | Medium | 6.1 | 2020-09-09 | SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send… |
CVE-2020-6311 | Medium | 6.5 | 2020-09-09 | Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform neces… |
CVE-2020-6361 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE files received from untrusted sources which results in crashing of the appl… |
CVE-2020-6360 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6359 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PLT file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6358 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6357 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6356 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6355 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6354 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6353 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6352 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6351 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6350 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6349 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6348 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6347 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6346 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6345 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6344 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6343 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6342 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6341 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6340 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6339 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6338 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RH file received from untrusted sources which results in crashing of the applic… |
CVE-2020-6337 | Medium | 4.3 | 2020-09-09 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in crashing of the appli… |