Patch days / December 2019

SAP Security Patch Day — December 2019

Tuesday, 10 December 2019

Vulnerabilities: 7
Critical: 0
High: 0
Zero-days: 0
Public exploit: 0

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

All vulnerabilities 7

Unscored7 Show

Unscored
CVE-2019-0395 SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launch…
Unscored
CVE-2019-0398 Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to…
Unscored
CVE-2019-0399 SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discove…
Unscored
CVE-2019-0402 SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information…
Unscored
CVE-2019-0403 SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Inject…
EPSS 2.1%
Unscored
CVE-2019-0404 SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure.
EPSS 1.1%
Unscored
CVE-2019-0405 SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a us…
EPSS 1.1%