SAP Security Patch Day — July 2019
Tuesday, 9 July 2019
- Vulnerabilities
- 11
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 0
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
All vulnerabilities 11
Unscored11 ShowHide
-
Unscored
CVE-2019-0281 SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site …EPSS 1.3%
-
Unscored
CVE-2019-0318 Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access…EPSS 1.3%
-
Unscored
CVE-2019-0319 The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could …EPSS 2.5%
-
Unscored
CVE-2019-0321 ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)…EPSS 1.3%
-
Unscored
CVE-2019-0322 SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate …EPSS 2.6%
- Unscored
-
Unscored
CVE-2019-0326 SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, re…EPSS 1.3%
-
Unscored
CVE-2019-0327 SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7…EPSS 2.1%
-
Unscored
CVE-2019-0328 ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wi…EPSS 3.4%
-
Unscored
CVE-2019-0329 SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.EPSS 1.3%
-
Unscored
CVE-2019-0330 The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject cod…EPSS 2.1%