SAP Security Patch Day — December 2018
Tuesday, 11 December 2018
- Vulnerabilities
- 9
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 0
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
All vulnerabilities 9
Unscored9 ShowHide
- Unscored
-
Unscored
CVE-2018-2492 SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2,…EPSS 1.1%
- Unscored
- Unscored
- Unscored
-
Unscored
CVE-2018-2502 TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service La…EPSS 1.3%
- Unscored
-
Unscored
CVE-2018-2504 SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross…EPSS 1.1%
-
Unscored
CVE-2018-2505 SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the …EPSS 1.3%