Vendor

SAP

1,623 known vulnerabilities.

Products

SAP 3D Visual Enterprise Viewer 127 SAP BusinessObjects Business Intelligence Platform 36 SAP 3D Visual Enterprise Author 27 SAP NetWeaver Enterprise Portal 22 SAP Business One 21 SAP NetWeaver Application Server for ABAP and ABAP Platform 18 SAP Enable Now 16 SAP NetWeaver AS ABAP and ABAP Platform 16 SAP NetWeaver Application Server for ABAP 15 SAP Disclosure Management 15 SAP HANA Extended Application Services 15 SAP Business Objects Business Intelligence Platform 15 SAP NetWeaver Application Server ABAP 14 SAP Commerce 14 SAP Commerce Cloud 13 SAP Internet Graphics Server 13 SAP NetWeaver Application Server ABAP and ABAP Platform 13 SAP NetWeaver Application Server Java 12 SAP GUI for Windows 12 SAP Financial Consolidation 11 SAP NetWeaver and ABAP Platform 11 SAP Business AI Platform (Approuter) 11 SAP Web Dispatcher 11 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) 10 SAP Host Agent 10 SAP CRM (WebClient UI) 10 SAP Cloud Connector 10 SAP NetWeaver AS Java 9 SAP Manufacturing Integration and Intelligence 9 SAP NetWeaver ABAP Server and ABAP Platform 8 SAP Solution Manager 8 SAP HANA 8 SAP Adaptive Server Enterprise 8 SAP HANA database 7 SAP Internet Graphics Service 7 SAP S/4HANA 7 NetWeaver AS for ABAP and ABAP Platform 7 SAP Internet Graphics Server (IGS) 7 SAP Business Connector 7 SAP NetWeaver AS ABAP 7

All Critical High Medium Low Exploited only Public exploit

779 results · Clear filters · Feed

Medium 6.1

CVE-2022-41260

SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unaut…

SAP SAP Financial Consolidation

Nov 8, 2022
Medium 5.4

CVE-2022-41208

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with…

SAP SAP Financial Consolidation

Nov 8, 2022
Medium 4.7

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site du…

SAP SAP NetWeaver ABAP Server and ABAP Platform

Nov 8, 2022
Medium 6.1

CVE-2022-41207

SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting…

SAP SAP Biller Direct

Nov 8, 2022
Medium 5.4

CVE-2022-41206

SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated att…

SAP SAP BusinessObjects Business Intelligence platform (Analysis for OLAP)

Oct 11, 2022
Medium 5.2

CVE-2022-41209

SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusi…

SAP SAP Customer Data Cloud (Gigya)

Oct 11, 2022
Medium 5.2

CVE-2022-41210

SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program whi…

SAP SAP Customer Data Cloud (Gigya)

Oct 11, 2022
Medium 6.1

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchp…

SAP SAP NetWeaver AS ABAP (SAP GUI for HTML within the Fiori Launchpad)

Sep 13, 2022
Medium 4.4

CVE-2020-6220

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently e…

SAP SAP Business Objects Business Intelligence Platform

Jun 6, 2022
Medium 5.9

CVE-2021-41251

Possibility to elevate privileges or get unauthorized access to data

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations…

SAP cloud-sdk-js @sap-cloud-sdk/core npm

Nov 5, 2021
Medium 6.3

CVE-2021-33704

The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions tha…

SAP SAP Business One

Sep 15, 2021
Medium 5.9

CVE-2021-33694

SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Admi…

SAP SAP Cloud Connector

Sep 15, 2021
Medium 6.9

CVE-2021-33691

NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting i…

SAP SAP NetWeaver Development Infrastructure (Notification Service)

Sep 15, 2021
Medium 5.7

CVE-2021-33693

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject mali…

SAP SAP Cloud Connector

Sep 15, 2021
Medium 4.7

CVE-2021-33697

Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow a…

SAP SAP BusinessObjects Business Intelligence Platform (SAPUI5)

Sep 15, 2021
Medium 6.8

CVE-2021-33695

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validatio…

SAP SAP Cloud Connector

Sep 15, 2021
Medium 5.2

CVE-2021-33692

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject…

SAP SAP Cloud Connector

Sep 15, 2021
Medium 5.4

CVE-2021-33696

SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode …

SAP SAP BusinessObjects Business Intelligence Platform (Crystal Report)

Sep 15, 2021
Medium 4.3

CVE-2021-38174

When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the…

SAP SAP 3D Visual Enterprise Viewer

Sep 14, 2021
Medium 5.3

CVE-2021-33686

Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encryp…

SAP SAP Business One

Sep 14, 2021
Medium 6.5

CVE-2021-33674

Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This a…

SAP SAP Contact Center

Sep 14, 2021
Medium 6.5

CVE-2021-33685

SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or dir…

SAP SAP Business One

Sep 14, 2021
Medium 6.5

CVE-2021-38175

SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over th…

SAP SAP Analysis for Microsoft Office

Sep 14, 2021
Medium 6.1

CVE-2021-33675

Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This a…

SAP SAP Contact Center

Sep 14, 2021
Medium 5.4

CVE-2021-33679

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to injec…

SAP SAP BusinessObjects Business Intelligence Platform (BI Workspace)

Sep 14, 2021
Medium 5.4

CVE-2021-38164

SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617,…

SAP SAP ERP Financial Accounting (RFOPENPOSTING_FR)

Sep 14, 2021
Medium 4.3

CVE-2021-37532

SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directo…

SAP SAP Business One

Sep 14, 2021
Medium 4.8

CVE-2021-21489

SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user …

SAP SAP NetWeaver Enterprise Portal

Sep 14, 2021
Medium 6.1

CVE-2021-38150

When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social eng…

SAP SAP Business Client

Sep 14, 2021
Medium 4.3

CVE-2021-33706

Due to improper input validation in InfraBox, logs can be modified by an authenticated user.

SAP InfraBox

Aug 10, 2021
Medium 6.1

CVE-2021-33707

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing…

SAP SAP NetWeaver Knowledge Management

Aug 10, 2021
Medium 5.4

CVE-2021-33682

SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (X…

SAP SAP Lumira Server

Jul 14, 2021
Medium 4.5

CVE-2021-33687

SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information …

SAP SAP NetWeaver AS JAVA (Enterprise Portal)

Jul 14, 2021
Medium 5.4

CVE-2021-33683

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32U…

SAP SAP Web Dispatcher and Internet Communication Manager

Jul 14, 2021
Medium 5.3

CVE-2021-33684

SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.2…

SAP SAP NetWeaver AS ABAP and ABAP Platform

Jul 14, 2021
Medium 6.5

CVE-2021-33678

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 74…

SAP SAP NetWeaver AS ABAP (Reconciliation Framework)

Jul 14, 2021
Medium 4.3

CVE-2021-33681

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted source…

SAP SAP 3D Visual Enterprise Viewer

Jul 14, 2021
Medium 6.5

CVE-2021-33677

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to ext…

SAP SAP NetWeaver AS ABAP and ABAP Platform

Jul 14, 2021
Medium 6.8

CVE-2021-33676

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with h…

SAP SAP CRM

Jul 14, 2021
Medium 4.3

CVE-2021-33680

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted source…

SAP SAP 3D Visual Enterprise Viewer

Jul 14, 2021

SAP

Products

SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unaut…

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with…

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site du…

SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting…

SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated att…

SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusi…

SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program whi…

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchp…

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently e…

Possibility to elevate privileges or get unauthorized access to data

The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions tha…

SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Admi…

NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting i…

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject mali…

Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow a…

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validatio…

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject…

SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode …

When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the…

Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encryp…

Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This a…

SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or dir…

SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over th…

Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This a…

The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to injec…

SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617,…

SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directo…

SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user …

When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social eng…

Due to improper input validation in InfraBox, logs can be modified by an authenticated user.

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing…

SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (X…

SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information …

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32U…

SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.2…

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 74…

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted source…

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to ext…

A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with h…

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted source…