Vendor
SAP
1,623 known vulnerabilities.
Products
69 results · Clear filters · Feed
-
Low 3.1
Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the a…
-
Low 3.7
Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the a…
-
Low 3.3
[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now
Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables which might be downloaded and executed by the user which could host malware. On successful exploita…
-
Low 3.7
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)
On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user cred…
-
Low 3.5
Missing Authorization check in SAP Bank Account Management
SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system.
-
Low 3.5
Client-side script execution vulnerability in SAP UI5(PDFViewer)
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in th…
-
Low 3.7
URL Redirection vulnerability in SAP Marketing (Contacts App)
SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.
-
Low 3.5
Denial of service (DOS) in SAP Cloud Connector
SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity …
-
Low 3.5
Directory Traversal vulnerability in SAP Master Data Governance
SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it ha…
-
Low 2.7
Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)
The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.
-
Low 3.5
External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browse…
-
Low 3.7
Information disclosure vulnerability in SAP Host Agent
Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive info…
-
Low 2.7
Denial of Service in SAP NetWeaver
SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavail…
-
Low 2.8
Missing Authorization Check in Vendor Master Hierarchy
Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for an authenticated use…
-
Low 3.7
Information Disclosure vulnerability in SAP BusinessObjects Platform
SAP BusinessObjects Platform - versions 420, 430, Information design tool transmits sensitive information as cleartext in the binaries over the network. This could allow an unauthenticated attacker with deep knowledge to gain sensitive information such as use…
-
Low 3.7
Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exp…
-
Low 3.1
Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confident…
-
Low 3.7
Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, ba…
-
Low 3.8
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not…
-
Low 3.5
When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator ap…
-
Low 3.4
In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific maliciou…
-
Low 3.6
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows a…
-
Low 3.4CVE-2020-26836 Scanner template
SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading t…
-
Low 2.6
In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can ac…
-
Low 2.7
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to acce…
-
Low 3.8
SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Ex…
-
Low 2.7
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6…
-
Low 3.7
SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.1…
-
Low 3.8
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in …