SAP Security Patch Day — July 2018
Tuesday, 10 July 2018
- Vulnerabilities
- 11
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 0
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
All vulnerabilities 11
Unscored11 ShowHide
-
Unscored
CVE-2018-2427 SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attac…EPSS 1.7%
-
Unscored
CVE-2018-2431 SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting…EPSS 1.3%
- Unscored
-
Unscored
CVE-2018-2433 SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7…EPSS 1.1%
- Unscored
-
Unscored
CVE-2018-2435 SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-S…EPSS 1.3%
-
Unscored
CVE-2018-2436 Executing transaction WRCK in SAP R/3 Enterprise Retail (EHP6) does not perform necessary authorization checks for an authenticated user, resulting in escalati…EPSS 1.3%
-
Unscored
CVE-2018-2437 The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions which can lead to: di…EPSS 3.3%
-
Unscored
CVE-2018-2438 The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacker to prevent legiti…EPSS 1.9%
-
Unscored
CVE-2018-2439 The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for a…EPSS 1.5%
- Unscored