SAP Security Patch Day — August 2018
Tuesday, 14 August 2018
- Vulnerabilities
- 10
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 0
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
All vulnerabilities 10
Unscored10 ShowHide
-
Unscored
CVE-2018-2441 Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7…EPSS 1%
- Unscored
-
Unscored
CVE-2018-2444 SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) …EPSS 1.3%
-
Unscored
CVE-2018-2445 AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted request…EPSS 1.1%
-
Unscored
CVE-2018-2446 Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (server name), hence l…EPSS 1.7%
-
Unscored
CVE-2018-2447 SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS…EPSS 1.2%
-
Unscored
CVE-2018-2448 Under certain conditions SAP SRM-MDM (CATALOG versions 3.0, 7.01, 7.02) utilities functionality allows an attacker to access information of user existence whic…EPSS 1.3%
-
Unscored
CVE-2018-2449 SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in (SAP NetWeaver 7.3) - import functionality does not perform authentication checks for valid repository user. T…EPSS 1.6%
-
Unscored
CVE-2018-2450 SAP MaxDB (liveCache), versions 7.8 and 7.9, allows an attacker who gets DBM operator privileges to execute crafted database queries and therefore read, modify…EPSS 1.7%
-
Unscored
CVE-2018-2451 XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolon…EPSS 1.1%