SAP Security Patch Day — May 2018
Tuesday, 8 May 2018
- Vulnerabilities
- 9
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 0
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
All vulnerabilities 9
Medium7 ShowHide
-
Medium 6.5
CVE-2018-2420 SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format …EPSS 1.5%
-
Medium 5.5
CVE-2018-2418 SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby cont…EPSS 1.7%
-
Medium 5.3
CVE-2018-2417 Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted.EPSS 1.3%
-
Medium 5.3
CVE-2018-2421 SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, eithe…EPSS 2.4%
-
Medium 5.3
CVE-2018-2422 SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, eithe…EPSS 1.8%
-
Medium 5.3
CVE-2018-2423 SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users from accessing a serv…EPSS 2.4%
-
Medium 4.7
CVE-2018-2415 SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30…EPSS 1.1%
Low1 ShowHide
- Low 3.7