SAP Security Patch Day — December 2021
Tuesday, 14 December 2021
- Vulnerabilities
- 12
- Critical
- 0
- High
- 0
- Zero-days
- 0
- Public exploit
- 1
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2021-42063 Public exploit Scanner template A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web b…EPSS 23%
All vulnerabilities 12
Unscored12 ShowHide
-
Unscored
CVE-2021-42063 Public exploit Scanner template A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web b…EPSS 23%
-
Unscored
CVE-2021-38182 Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the…EPSS 1.1%
- Unscored
-
Unscored
CVE-2021-42064 If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions …EPSS 1.1%
- Unscored
- Unscored
-
Unscored
CVE-2021-42069 When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applic…EPSS 1.1%
- Unscored
-
Unscored
CVE-2021-44231 Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavio…EPSS 1.3%
-
Unscored
CVE-2021-44232 SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leading to full server d…EPSS 1%
- Unscored
- Unscored