Sap Se
Page 5 of 6 — Sap Se CVEs from a corpus of 555, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-44112 | Medium | 4.3 | 2024-09-10 | Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a… |
CVE-2024-41728 | Low | 2.7 | 2024-09-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects con… |
CVE-2024-44116 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to id… |
CVE-2024-44115 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify u… |
CVE-2024-44114 | Low | 2.0 | 2024-09-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This resu… |
CVE-2024-44113 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is oth… |
CVE-2024-42380 | Medium | 4.3 | 2024-09-10 | The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each nod… |
CVE-2024-42378 | Medium | 6.1 | 2024-09-10 | Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to… |
CVE-2024-42371 | Medium | 5.4 | 2024-09-10 | The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify u… |
CVE-2024-41729 | Medium | 4.3 | 2024-09-10 | Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On… |
CVE-2024-42373 | Medium | 4.3 | 2024-08-13 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-41734 | Medium | 4.3 | 2024-08-13 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction… |
CVE-2024-39591 | Medium | 4.3 | 2024-08-13 | SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact o… |
CVE-2024-42377 | Medium | 4.3 | 2024-08-13 | SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries i… |
CVE-2024-42376 | Medium | 6.5 | 2024-08-13 | SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exp… |
CVE-2024-42375 | Medium | 4.3 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-42374 | High | 8.2 | 2024-08-13 | BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information… |
CVE-2024-41737 | Medium | 5.0 | 2024-08-13 | SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On… |
CVE-2024-41736 | Medium | 4.3 | 2024-08-13 | Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on th… |
CVE-2024-41735 | Medium | 5.4 | 2024-08-13 | SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confid… |
CVE-2024-41733 | Medium | 5.3 | 2024-08-13 | In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a giv… |
CVE-2024-41732 | Medium | 4.7 | 2024-08-13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web app… |
CVE-2024-41731 | Low | 3.1 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the ap… |
CVE-2024-41730 | Critical | 9.8 | 2024-08-13 | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token… |
CVE-2024-33005 | Medium | 6.3 | 2024-08-13 | Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP… |
CVE-2024-33003 | High | 7.4 | 2024-08-13 | Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon… |
CVE-2024-28166 | Low | 3.7 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-39600 | Medium | 5.0 | 2024-07-09 | Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of… |
CVE-2024-39599 | Medium | 4.7 | 2024-07-09 | Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API… |
CVE-2024-39596 | Medium | 4.3 | 2024-07-09 | Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be restricted. On succ… |
CVE-2024-39595 | Medium | 5.4 | 2024-07-09 | SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scrip… |
CVE-2024-39594 | Medium | 6.1 | 2024-07-09 | SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Sc… |
CVE-2024-37180 | Medium | 4.1 | 2024-07-09 | Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furthe… |
CVE-2024-37175 | Medium | 4.3 | 2024-07-09 | SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker… |
CVE-2024-37172 | Medium | 5.4 | 2024-07-09 | SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileg… |
CVE-2024-37171 | Medium | 5.0 | 2024-07-09 | SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web appl… |
CVE-2024-34692 | Low | 3.3 | 2024-07-09 | Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables… |
CVE-2024-34689 | Medium | 5.0 | 2024-07-09 | WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting… |
CVE-2024-39598 | Medium | 5.0 | 2024-07-09 | SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP req… |
CVE-2024-39597 | High | 7.2 | 2024-07-09 | In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registrati… |
CVE-2024-39593 | Medium | 6.9 | 2024-07-09 | SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can… |
CVE-2024-39592 | High | 7.7 | 2024-07-09 | Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker t… |
CVE-2024-37174 | Medium | 6.1 | 2024-07-09 | Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On succe… |
CVE-2024-37173 | Medium | 6.1 | 2024-07-09 | Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a v… |
CVE-2024-34685 | Medium | 6.1 | 2024-07-09 | Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application… |
CVE-2024-37176 | Medium | 5.5 | 2024-06-11 | SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting i… |
CVE-2024-34691 | Medium | 6.5 | 2024-06-11 | Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of priv… |
CVE-2024-34690 | Medium | 5.4 | 2024-06-11 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-34688 | High | 7.5 | 2024-06-11 | Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prev… |
CVE-2024-34686 | Medium | 6.1 | 2024-06-11 | Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victi… |
CVE-2024-34684 | Low | 3.7 | 2024-06-11 | On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to acce… |
CVE-2024-34683 | Medium | 6.5 | 2024-06-11 | An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, mod… |
CVE-2024-33001 | Medium | 6.5 | 2024-06-11 | SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial… |
CVE-2024-28164 | Medium | 5.3 | 2024-06-11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be re… |
CVE-2024-37178 | Medium | 5.0 | 2024-06-11 | SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exp… |
CVE-2024-37177 | High | 8.1 | 2024-06-11 | SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the… |
CVE-2024-4139 | Medium | 4.3 | 2024-05-14 | Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By e… |
CVE-2024-4138 | Medium | 4.3 | 2024-05-14 | Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By e… |
CVE-2024-34687 | Medium | 6.5 | 2024-05-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerab… |
CVE-2024-33009 | Medium | 4.2 | 2024-05-14 | SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting… |
CVE-2024-33008 | Medium | 4.9 | 2024-05-14 | SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memor… |
CVE-2024-33007 | Low | 3.5 | 2024-05-14 | PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded Java… |
CVE-2024-33006 | Critical | 9.6 | 2024-05-14 | An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system. |
CVE-2024-33004 | Medium | 4.3 | 2024-05-14 | SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On succes… |
CVE-2024-33002 | Medium | 6.1 | 2024-05-14 | Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) v… |
CVE-2024-33000 | Low | 3.5 | 2024-05-14 | SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a… |
CVE-2024-32733 | Medium | 6.1 | 2024-05-14 | Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attac… |
CVE-2024-32731 | Medium | 5.5 | 2024-05-14 | SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploit… |
CVE-2024-28165 | High | 8.1 | 2024-05-14 | SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which c… |
CVE-2024-32730 | Medium | 6.5 | 2024-05-14 | SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploita… |
CVE-2024-30218 | Medium | 6.5 | 2024-04-09 | The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashi… |
CVE-2024-30217 | Medium | 4.3 | 2024-04-09 | Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting… |
CVE-2024-30216 | Medium | 4.3 | 2024-04-09 | Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting… |
CVE-2024-30215 | Medium | 4.8 | 2024-04-09 | The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a succes… |
CVE-2024-30214 | Medium | 4.8 | 2024-04-09 | The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response… |
CVE-2024-28167 | Medium | 6.5 | 2024-04-09 | SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On succes… |
CVE-2024-27901 | High | 7.2 | 2024-04-09 | SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to… |
CVE-2024-27899 | High | 8.8 | 2024-04-09 | Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of t… |
CVE-2024-27898 | Medium | 5.3 | 2024-04-09 | SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting inter… |
CVE-2024-25646 | High | 7.7 | 2024-04-09 | Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using c… |
CVE-2024-28163 | Medium | 5.3 | 2024-03-12 | Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would oth… |
CVE-2024-27902 | Medium | 5.4 | 2024-03-12 | Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2024-27900 | Medium | 4.3 | 2024-03-12 | Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job template… |
CVE-2024-25645 | Medium | 5.3 | 2024-03-12 | Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing l… |
CVE-2024-25644 | Medium | 5.3 | 2024-03-12 | Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on… |
CVE-2024-22133 | Medium | 4.6 | 2024-03-12 | SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to… |
CVE-2024-22127 | Critical | 9.1 | 2024-03-12 | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous… |
CVE-2024-25643 | Medium | 4.3 | 2024-02-13 | The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an esc… |
CVE-2024-24741 | Medium | 4.3 | 2024-02-13 | SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an… |
CVE-2024-22129 | Medium | 5.4 | 2024-02-13 | SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would… |
CVE-2024-25642 | High | 7.4 | 2024-02-13 | Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the… |
CVE-2024-24743 | High | 8.6 | 2024-02-13 | SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over t… |
CVE-2024-24742 | Medium | 4.1 | 2024-02-13 | SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF… |
CVE-2024-24740 | Medium | 5.3 | 2024-02-13 | SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, un… |
CVE-2024-24739 | Medium | 6.3 | 2024-02-13 | SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low im… |
CVE-2024-22132 | High | 7.4 | 2024-02-13 | SAP IDES ECC-systems contain code that permits the execution of arbitrary program code of user's choice.An attacker can therefore control the behaviour of the… |
CVE-2024-22131 | Critical | 9.1 | 2024-02-13 | In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authori… |
CVE-2024-22130 | High | 7.6 | 2024-02-13 | Print preview option in SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701… |
CVE-2024-22128 | Medium | 4.7 | 2024-02-13 | SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently… |
CVE-2024-22126 | Medium | 6.1 | 2024-02-13 | The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before incl… |