Vendor

SAP

1,623 known vulnerabilities.

Products

SAP 3D Visual Enterprise Viewer 127 SAP BusinessObjects Business Intelligence Platform 36 SAP 3D Visual Enterprise Author 27 SAP NetWeaver Enterprise Portal 22 SAP Business One 21 SAP NetWeaver Application Server for ABAP and ABAP Platform 18 SAP Enable Now 16 SAP NetWeaver AS ABAP and ABAP Platform 16 SAP NetWeaver Application Server for ABAP 15 SAP Disclosure Management 15 SAP HANA Extended Application Services 15 SAP Business Objects Business Intelligence Platform 15 SAP NetWeaver Application Server ABAP 14 SAP Commerce 14 SAP Commerce Cloud 13 SAP Internet Graphics Server 13 SAP NetWeaver Application Server ABAP and ABAP Platform 13 SAP NetWeaver Application Server Java 12 SAP GUI for Windows 12 SAP Financial Consolidation 11 SAP NetWeaver and ABAP Platform 11 SAP Business AI Platform (Approuter) 11 SAP Web Dispatcher 11 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) 10 SAP Host Agent 10 SAP CRM (WebClient UI) 10 SAP Cloud Connector 10 SAP NetWeaver AS Java 9 SAP Manufacturing Integration and Intelligence 9 SAP NetWeaver ABAP Server and ABAP Platform 8 SAP Solution Manager 8 SAP HANA 8 SAP Adaptive Server Enterprise 8 SAP HANA database 7 SAP Internet Graphics Service 7 SAP S/4HANA 7 NetWeaver AS for ABAP and ABAP Platform 7 SAP Internet Graphics Server (IGS) 7 SAP Business Connector 7 SAP NetWeaver AS ABAP 7

All Critical High Medium Low Exploited only Public exploit

779 results · Clear filters · Feed

Medium 4.3

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions…

SAP SAP NetWeaver ABAP Server and ABAP Platform

Aug 12, 2020
Medium 5.4

CVE-2020-6301

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unautho…

SAP SAP ERP (HCM Travel Management)

Aug 12, 2020
Medium 4.8

CVE-2020-6300

SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacke…

SAP SAP Business Objects Business Intelligence Platform (Central Management Console)

Aug 12, 2020
Medium 4.3

CVE-2020-6299

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to …

SAP SAP NetWeaver ABAP Server and ABAP Platform

Aug 12, 2020
Medium 6.3

CVE-2020-6297

Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to…

SAP SAP Data Intelligence

Aug 12, 2020
Medium 4.3

CVE-2020-6273

SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization chec…

SAP SAP S/4 HANA (Fiori UI for General Ledger Accounting)

Aug 12, 2020
Medium 4.2

CVE-2020-6290

SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user…

SAP SAP Disclosure Management

Jul 14, 2020
Medium 6.3

CVE-2020-6267

Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cook…

SAP SAP Disclosure Management

Jul 14, 2020
Medium 6.1

CVE-2020-6276

SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controll…

SAP SAP Business Objects Business Intelligence Platform (bipodata)

Jul 14, 2020
Medium 5.4

CVE-2020-6291

SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited…

SAP SAP Disclosure Management

Jul 14, 2020
Medium 6.1

CVE-2020-6281

SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-cont…

SAP SAP Business Objects Business Intelligence Platform (BI Launchpad)

Jul 14, 2020
Medium 5.4

CVE-2020-6278

SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to…

SAP SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)

Jul 14, 2020
Medium 5.3

CVE-2020-6286 Public exploit EPSS 24%

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…

SAP SAP NetWeaver AS JAVA (LM Configuration Wizard)

Jul 14, 2020
Medium 4.6

CVE-2020-6292

Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to…

SAP SAP Disclosure Management

Jul 14, 2020
Medium 5.8

CVE-2020-6282

SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver…

SAP SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS) SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE)

Jul 14, 2020
Medium 4.3

CVE-2020-6289

SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be…

SAP SAP Disclosure Management

Jul 14, 2020
Medium 5.3

CVE-2020-6261

SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file,…

SAP SAP Solution Manager (Trace Analysis)

Jul 1, 2020
Medium 5.4

CVE-2020-6266

SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due …

SAP SAP Fiori for SAP S/4HANA

Jun 10, 2020
Medium 6.9

CVE-2020-6263

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10…

SAP SAP NetWeaver AS Java

Jun 10, 2020
Medium 6.5

CVE-2020-6260

SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed…

SAP SAP Solution Manager (Trace Analysis)

Jun 10, 2020
Medium 4.3

CVE-2020-6269

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access…

SAP SAP Business Objects Business Intelligence Platform

Jun 10, 2020
Medium 6.5

CVE-2020-6270

SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not pe…

SAP SAP NetWeaver AS ABAP (Banking Services)

Jun 10, 2020
Medium 5.4

CVE-2020-6268

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 8…

SAP SAP ERP (Statutory Reporting for Insurance Companies)

Jun 10, 2020
Medium 6.1

CVE-2020-6246

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750,…

SAP SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_TABLE)

Jun 10, 2020
Medium 4.4

CVE-2020-6239

Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissio…

SAP SAP Business One (Backup service)

Jun 10, 2020
Medium 4.3

CVE-2020-6258

SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowi…

SAP SAP Identity Management

May 12, 2020
Medium 6.1

CVE-2020-6254

SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors…

SAP SAP Enterprise Threat Detection

May 12, 2020
Medium 6.5

CVE-2020-6259

Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information …

SAP SAP Adaptive Server Enterprise

May 12, 2020
Medium 5.4

CVE-2020-6257

SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-contro…

SAP SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad)

May 12, 2020
Medium 6.8

CVE-2020-6250

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoin…

SAP SAP Adaptive Server Enterprise

May 12, 2020
Medium 5.4

CVE-2020-6256

SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change…

SAP SAP Master Data Governance

May 12, 2020
Medium 5.4

CVE-2020-6251

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an…

SAP SAP BusinessObjects Business Intelligence Platform

May 12, 2020
Medium 5.9

CVE-2020-6247

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitim…

SAP SAP Business Objects Business Intelligence Platform

May 12, 2020
Medium 6.5

CVE-2020-6245

SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to …

SAP SAP Business Objects Business Intelligence Platform

May 12, 2020
Medium 5.3

CVE-2020-6240

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) all…

SAP SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI) SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)

May 12, 2020
Medium 5.4

CVE-2020-6212

Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versio…

SAP SAP ERP SAP S/4 HANA

Apr 24, 2020
Medium 6.1

CVE-2020-6213

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750…

SAP SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_PHTMLB)

Apr 24, 2020
Medium 6.1

CVE-2020-6211

SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect use…

SAP SAP Business Objects Business Intelligence Platform

Apr 14, 2020
Medium 6.1

CVE-2020-6217

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752…

SAP SAP NetWeaver AS ABAP (Business Server Pages Test Application IT05)

Apr 14, 2020
Medium 6.4

CVE-2020-6195

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, …

SAP SAP Business Objects Business Intelligence Platform

Apr 14, 2020

SAP

Products

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions…

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unautho…

SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacke…

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to …

Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to…

SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization chec…

SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user…

Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cook…

SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controll…

SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited…

SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-cont…

SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to…

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…

Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to…

SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver…

SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be…

SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file,…

SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due …

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10…

SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed…

Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access…

SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not pe…

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 8…

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750,…

Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissio…

SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowi…

SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors…

Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information …

SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-contro…

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoin…

SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change…

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an…

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitim…

SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to …

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) all…

Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versio…

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750…

SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect use…

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752…

SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, …