SAP Security Patch Day — November 2018
Tuesday, 13 November 2018
- Vulnerabilities
- 14
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 0
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
All vulnerabilities 14
Unscored14 ShowHide
-
Unscored
CVE-2018-2473 SAP BusinessObjects Business Intelligence Platform Server, versions 4.1 and 4.2, when using Web Intelligence Richclient 3 tiers mode gateway allows an attacker…EPSS 1.5%
- Unscored
-
Unscored
CVE-2018-2477 Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted …EPSS 1.7%
-
Unscored
CVE-2018-2478 An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02, 7.10 to 7.11, 7.30…EPSS 1.8%
-
Unscored
CVE-2018-2479 SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross…EPSS 1.3%
-
Unscored
CVE-2018-2481 In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is us…EPSS 1.5%
-
Unscored
CVE-2018-2482 SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimate users from acces…EPSS 2%
- Unscored
-
Unscored
CVE-2018-2485 It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and…EPSS 1.2%
-
Unscored
CVE-2018-2487 SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in specific use cases, file…EPSS 1.5%
- Unscored
- Unscored
- Unscored
- Unscored