Vendor
SAP
1,623 known vulnerabilities.
Products
779 results · Clear filters · Feed
-
Medium 6.8
XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)
SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files a…
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)
Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP Content Server
SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can read and modify some sensitive information but cannot delete the data.
-
Medium 6.5
Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an unused class for error handling in which an attacker authenticated as a non-adminis…
-
Medium 6.8
SQL Injection vulnerability in SAP ABAP Platform
Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the current session of the user by injecting the malicious database queries over the network and gain access t…
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java (Classload Service)
SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of t…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver
Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. …
-
Medium 6.1
SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756…
-
Medium 6.1
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 7…
-
Medium 6.5
SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to…
-
Medium 4.3
SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inp…
-
Medium 6.5
SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticate…
-
Medium 6.1
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 74…
-
Medium 6.1
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, …
-
Medium 6.1
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
-
Medium 6.1
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 7…
-
Medium 4.3
In SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json wi…
-
Medium 6.5
SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insuf…
-
Medium 6.1
An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740…
-
Medium 6.1
SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting …
-
Medium 5.4
SAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business authorization to upload a…
-
Medium 6.5
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which…
-
Medium 6.5
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which…
-
Medium 6.5
In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V…
-
Medium 4.5
Information Disclosure in SAP Bank Account Management (Manage Banks)
In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the appl…
-
Medium 4.6
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence)
In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. As a result, a custom application that calls directly the jsp of Web Intellige…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulner…
-
Medium 6.4
Local Privilege Escalation in SAP Host Agent (Windows)
In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. Note that by default all user members of SA…
-
Medium 6.1
In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link th…
-
Medium 6.5
SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application…
-
Medium 4.3
Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker ca…
-
Medium 4.3
Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - version…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthent…
-
Medium 6.0
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a …
-
Medium 6.0
Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Netwo…
-
Medium 5.5
SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attac…
-
Medium 4.9
Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with h…
-
Medium 6.5
Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to i…
-
Medium 6.5
SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anyw…