Sap Se
Page 6 of 6 — Sap Se CVEs from a corpus of 555, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22125 | High | 7.4 | 2024-01-09 | Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to access highly sensiti… |
CVE-2024-22124 | Medium | 4.1 | 2024-01-09 | Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC… |
CVE-2024-21738 | Medium | 4.1 | 2024-01-09 | SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilit… |
CVE-2024-21737 | High | 8.4 | 2024-01-09 | In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execu… |
CVE-2024-21736 | Medium | 6.4 | 2024-01-09 | SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import c… |
CVE-2024-21735 | High | 7.3 | 2024-01-09 | SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. Th… |
CVE-2024-21734 | Low | 3.7 | 2024-01-09 | SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing… |
CVE-2023-50424 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalat… |
CVE-2023-6542 | High | 7.1 | 2023-12-12 | Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep… |
CVE-2023-50423 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successfu… |
CVE-2023-50422 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3… |
CVE-2023-49587 | Medium | 6.4 | 2023-12-12 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other… |
CVE-2023-49584 | Medium | 4.3 | 2023-12-12 | SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTT… |
CVE-2023-49583 | Critical | 9.1 | 2023-12-12 | SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successf… |
CVE-2023-49581 | Medium | 4.1 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addit… |
CVE-2023-49580 | High | 7.3 | 2023-12-12 | SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access inf… |
CVE-2023-49578 | Low | 3.5 | 2023-12-12 | SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious… |
CVE-2023-49577 | Medium | 6.1 | 2023-12-12 | The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, re… |
CVE-2023-49058 | Low | 3.5 | 2023-12-12 | SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters… |
CVE-2023-42481 | High | 8.1 | 2023-12-12 | In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten pas… |
CVE-2023-42479 | Medium | 6.1 | 2023-12-12 | An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting requ… |
CVE-2023-42478 | High | 7.5 | 2023-12-12 | SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when open… |
CVE-2023-42476 | Medium | 6.8 | 2023-12-12 | SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then… |
CVE-2023-42480 | Medium | 5.3 | 2023-11-14 | The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids… |
CVE-2023-41366 | Medium | 5.3 | 2023-11-14 | Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7… |
CVE-2023-31403 | Critical | 9.6 | 2023-11-14 | SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious… |
CVE-2023-42477 | Medium | 6.5 | 2023-10-10 | SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limi… |
CVE-2023-42475 | Medium | 4.3 | 2023-10-10 | The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impa… |
CVE-2023-42474 | Medium | 6.8 | 2023-10-10 | SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link t… |
CVE-2023-42473 | Medium | 5.4 | 2023-10-10 | S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of pri… |
CVE-2023-41365 | Medium | 4.3 | 2023-10-10 | SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, whi… |
CVE-2023-40310 | Medium | 6.5 | 2023-10-10 | SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external ent… |
CVE-2023-40625 | Medium | 5.4 | 2023-09-12 | S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This… |
CVE-2023-40624 | Medium | 5.5 | 2023-09-12 | SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS… |
CVE-2023-40623 | Medium | 6.2 | 2023-09-12 | SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a… |
CVE-2023-40622 | Critical | 9.9 | 2023-09-12 | SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view… |
CVE-2023-40621 | Medium | 6.3 | 2023-09-12 | SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, t… |
CVE-2023-40309 | Critical | 9.8 | 2023-09-12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resu… |
CVE-2023-42472 | High | 8.7 | 2023-09-12 | Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report c… |
CVE-2023-41369 | Low | 3.5 | 2023-09-12 | The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an at… |
CVE-2023-41368 | Low | 2.7 | 2023-09-12 | The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating… |
CVE-2023-41367 | Medium | 5.3 | 2023-09-12 | Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admi… |
CVE-2023-40308 | High | 7.5 | 2023-09-12 | SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library w… |
CVE-2023-37489 | Medium | 5.3 | 2023-09-12 | Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to… |
CVE-2023-39438 | High | 8.1 | 2023-08-15 | A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific addit… |
CVE-2023-39440 | Medium | 4.4 | 2023-08-08 | In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be c… |
CVE-2023-39439 | High | 8.8 | 2023-08-08 | SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase. |
CVE-2023-39437 | High | 7.6 | 2023-08-08 | SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the… |
CVE-2023-39436 | Medium | 5.8 | 2023-08-08 | SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM… |
CVE-2023-37492 | Medium | 4.9 | 2023-08-08 | SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SA… |
CVE-2023-37491 | High | 7.5 | 2023-08-08 | The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53… |
CVE-2023-37490 | High | 7.6 | 2023-08-08 | SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary… |
CVE-2023-37488 | Medium | 6.1 | 2023-08-08 | In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could resu… |
CVE-2023-37487 | Medium | 5.3 | 2023-08-08 | SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over… |
CVE-2023-37486 | Medium | 5.9 | 2023-08-08 | Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which wo… |
CVE-2023-37484 | Medium | 5.3 | 2023-08-08 | SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which mi… |
CVE-2023-37483 | Critical | 9.8 | 2023-08-08 | SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end datab… |
CVE-2023-36926 | Low | 3.7 | 2023-08-08 | Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibili… |
CVE-2023-36923 | High | 7.8 | 2023-08-08 | SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library… |
CVE-2023-33993 | High | 7.1 | 2023-08-08 | B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or… |
CVE-2023-36925 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the a… |
CVE-2023-36924 | Medium | 4.9 | 2023-07-11 | While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows… |
CVE-2023-36922 | Critical | 9.1 | 2023-07-11 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary ope… |
CVE-2023-36921 | High | 7.2 | 2023-07-11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to… |
CVE-2023-36919 | Medium | 5.3 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not i… |
CVE-2023-36918 | Medium | 6.1 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header i… |
CVE-2023-36917 | Medium | 5.9 | 2023-07-11 | SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass th… |
CVE-2023-35874 | Medium | 6.0 | 2023-07-11 | SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7… |
CVE-2023-35873 | Medium | 6.5 | 2023-07-11 | The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities… |
CVE-2023-35872 | Medium | 6.5 | 2023-07-11 | The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities… |
CVE-2023-35871 | High | 7.7 | 2023-07-11 | The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53… |
CVE-2023-35870 | Medium | 6.3 | 2023-07-11 | When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the sav… |
CVE-2023-33992 | Medium | 4.5 | 2023-07-11 | The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 10… |
CVE-2023-33990 | High | 7.8 | 2023-07-11 | SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privil… |
CVE-2023-33989 | High | 8.7 | 2023-07-11 | An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to o… |
CVE-2023-33988 | Medium | 6.1 | 2023-07-11 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protec… |
CVE-2023-33987 | High | 8.6 | 2023-07-11 | An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88… |
CVE-2023-31405 | Medium | 5.3 | 2023-07-11 | SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network wh… |
CVE-2023-33991 | High | 8.2 | 2023-06-13 | SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inpu… |
CVE-2023-33986 | Medium | 6.1 | 2023-06-13 | SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripti… |
CVE-2023-33985 | Medium | 6.1 | 2023-06-13 | SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripti… |
CVE-2023-33984 | Medium | 6.4 | 2023-06-13 | SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker t… |
CVE-2023-32115 | Medium | 4.2 | 2023-06-13 | An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional inform… |
CVE-2023-32114 | Low | 2.7 | 2023-06-13 | SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privilege… |
CVE-2023-2827 | High | 7.9 | 2023-06-13 | SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON… |
CVE-2023-32113 | High | 7.5 | 2023-05-09 | SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a pre… |
CVE-2023-32112 | Low | 2.8 | 2023-05-09 | Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617… |
CVE-2023-32111 | High | 7.5 | 2023-05-09 | In SAP PowerDesigner (Proxy) - version 16.7, an attacker can send a crafted request from a remote host to the proxy machine and crash the proxy server, due to… |
CVE-2023-31407 | Medium | 5.4 | 2023-05-09 | SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulner… |
CVE-2023-31406 | Medium | 6.1 | 2023-05-09 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect us… |
CVE-2023-31404 | Medium | 5.0 | 2023-05-09 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (Central Management Service) - versions 420, 430, allows an attacker to access inf… |
CVE-2023-30744 | High | 8.2 | 2023-05-09 | In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use… |
CVE-2023-30743 | High | 7.1 | 2023-05-09 | Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5… |
CVE-2023-30742 | Medium | 6.1 | 2023-05-09 | SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF… |
CVE-2023-30741 | Medium | 6.1 | 2023-05-09 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect us… |
CVE-2023-30740 | Medium | 6.3 | 2023-05-09 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise res… |
CVE-2023-29188 | Medium | 5.4 | 2023-05-09 | SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF… |
CVE-2023-28764 | Low | 3.7 | 2023-05-09 | SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This c… |
CVE-2023-28762 | Critical | 9.1 | 2023-05-09 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token o… |
CVE-2023-27499 | Medium | 6.1 | 2023-04-11 | SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode… |