Vendor

SAP

1,623 known vulnerabilities.

Products

SAP 3D Visual Enterprise Viewer 127 SAP BusinessObjects Business Intelligence Platform 36 SAP 3D Visual Enterprise Author 27 SAP NetWeaver Enterprise Portal 22 SAP Business One 21 SAP NetWeaver Application Server for ABAP and ABAP Platform 18 SAP Enable Now 16 SAP NetWeaver AS ABAP and ABAP Platform 16 SAP NetWeaver Application Server for ABAP 15 SAP Disclosure Management 15 SAP HANA Extended Application Services 15 SAP Business Objects Business Intelligence Platform 15 SAP NetWeaver Application Server ABAP 14 SAP Commerce 14 SAP Commerce Cloud 13 SAP Internet Graphics Server 13 SAP NetWeaver Application Server ABAP and ABAP Platform 13 SAP NetWeaver Application Server Java 12 SAP GUI for Windows 12 SAP Financial Consolidation 11 SAP NetWeaver and ABAP Platform 11 SAP Business AI Platform (Approuter) 11 SAP Web Dispatcher 11 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) 10 SAP Host Agent 10 SAP CRM (WebClient UI) 10 SAP Cloud Connector 10 SAP NetWeaver AS Java 9 SAP Manufacturing Integration and Intelligence 9 SAP NetWeaver ABAP Server and ABAP Platform 8 SAP Solution Manager 8 SAP HANA 8 SAP Adaptive Server Enterprise 8 SAP HANA database 7 SAP Internet Graphics Service 7 SAP S/4HANA 7 NetWeaver AS for ABAP and ABAP Platform 7 SAP Internet Graphics Server (IGS) 7 SAP Business Connector 7 SAP NetWeaver AS ABAP 7

All Critical High Medium Low Exploited only Public exploit

779 results · Clear filters · Feed

Medium 5.3

CVE-2020-6232

SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missin…

SAP SAP Commerce

Apr 14, 2020
Medium 4.3

CVE-2020-6233

SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allow…

SAP SAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL) SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL)

Apr 14, 2020
Medium 5.4

CVE-2020-6226

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficient…

SAP SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)

Apr 14, 2020
Medium 5.4

CVE-2020-6231

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficient…

SAP SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)

Apr 14, 2020
Medium 5.3

CVE-2020-6228

SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an atta…

SAP SAP Business Client

Apr 14, 2020
Medium 4.5

CVE-2020-6224

SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with admini…

SAP SAP NetWeaver AS Java (HTTP Service)

Apr 14, 2020
Medium 6.1

CVE-2020-6229

SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 74…

SAP SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME)

Apr 14, 2020
Medium 5.3

CVE-2020-6227

SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send speci…

SAP SAP Business Objects Business Intelligence Platform (CMS / Auditing issues)

Apr 14, 2020
Medium 5.4

CVE-2020-6222

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not suff…

SAP SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Apr 14, 2020
Medium 6.1

CVE-2020-6216

SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-cont…

SAP SAP Business Objects Business Intelligence Platform (BI Launchpad)

Apr 14, 2020
Medium 5.4

CVE-2020-6221

Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not suf…

SAP SAP BusinessObjects Business Intelligence Platform

Apr 14, 2020
Medium 6.1

CVE-2020-6223

The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modi…

SAP SAP Business Objects Business Intelligence Platform

Apr 14, 2020
Medium 5.0

CVE-2020-6218

Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an atta…

SAP SAP Business Objects Business Intelligence Platform

Apr 14, 2020
Medium 4.7

CVE-2020-6214

SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Althou…

SAP SAP S/4HANA (Financial Products Subledger)

Apr 14, 2020
Medium 6.1

CVE-2020-6215

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752…

SAP SAP NetWeaver AS ABAP (Business Server Pages Test Application IT00)

Apr 14, 2020
Medium 4.7

CVE-2020-6210

SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the at…

SAP SAP Fiori Launchpad

Mar 10, 2020
Medium 4.7

CVE-2020-6206

SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning m…

SAP SAP Cloud Platform Integration for Data Services

Mar 10, 2020
Medium 6.1

CVE-2020-6205

SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31…

SAP SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS

Mar 10, 2020
Medium 4.3

CVE-2020-6204

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 60…

SAP SAP Treasury and Risk Management (Transaction Management) (S4CORE) SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)

Mar 10, 2020
Medium 5.5

CVE-2020-6202

SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; doe…

SAP SAP NetWeaver Application Server Java (User Management Engine)

Mar 10, 2020
Medium 6.1

CVE-2020-6201

The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlle…

SAP SAP Commerce Cloud (Testweb Extension)

Mar 10, 2020
Medium 5.4

CVE-2020-6200

The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template…

SAP SAP Commerce Cloud (SmartEdit Extension)

Mar 10, 2020
Medium 5.4

CVE-2020-6199

The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and…

SAP SAP ERP (SAP_FIN) SAP S/4HANA (S4CORE) SAP ERP (EAPPGLO)

Mar 10, 2020
Medium 5.4

CVE-2020-6178

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser hi…

SAP SAP Enable Now

Mar 10, 2020
Medium 5.4

CVE-2020-6185

Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS ver…

SAP SAP NetWeaver (SAP Basis) SAP S/4HANA (SAP Basis)

Feb 12, 2020
Medium 5.8

CVE-2020-6181

Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SA…

SAP SAP NetWeaver (SAP Basis) SAP ABAP Platform (SAP Basis)

Feb 12, 2020
Medium 5.3

CVE-2020-6183

SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by se…

SAP SAP Host Agent

Feb 12, 2020
Medium 6.1

CVE-2020-6184

Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS ve…

SAP Automated Note Search Tool (SAP Basis)

Feb 12, 2020
Medium 6.3

CVE-2020-6188

VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700…

SAP SAP ERP (SAP_FIN) SAP ERP (SAP_APPL) SAP S/4 HANA (S4CORE)

Feb 12, 2020
Medium 5.8

CVE-2020-6190

Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide…

SAP SAP NetWeaver AS Java (Heap Dump Application)

Feb 12, 2020
Medium 5.3

CVE-2020-6189

Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error mes…

SAP SAP Business Objects Business Intelligence Platform (CMC)

Feb 12, 2020
Medium 4.9

CVE-2020-6187

SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an…

SAP SAP NetWeaver (Guided Procedures)

Feb 12, 2020
Medium 4.3

CVE-2020-6177

SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source whic…

SAP SAP Mobile Platform

Feb 12, 2020
Medium 6.1

CVE-2020-6193

SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker t…

SAP SAP NetWeaver (Knowledge Management ICE Service)

Feb 12, 2020
Medium 4.3

CVE-2020-6307

Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) do…

SAP Automated Note Search Tool (SAP Basis)

Jan 14, 2020
Medium 5.9

CVE-2020-6304

Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21…

SAP SAP NetWeaver Internet Communication Manager (KRNL64UC) SAP NetWeaver Internet Communication Manager (KRNL32NUC) SAP NetWeaver Internet Communication Manager (KRNL64NUC)

Jan 14, 2020
Medium 5.4

CVE-2020-6303

SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to …

SAP SAP Disclosure Management

Jan 14, 2020
Medium 6.1

CVE-2020-6305

PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode …

SAP SAP Process Integration - Rest Adapter (SAP_XIAF)

Jan 14, 2020
Medium 5.3

CVE-2018-2428

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. …

SAP SAP UI SAP UI for SAP NetWeaver 7.00 SAP Infrastructure

Jun 12, 2018
Medium 5.3

CVE-2018-2417

Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access informati…

SAP SAP Identity Management

May 9, 2018

SAP

Products

SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missin…

SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allow…

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficient…

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficient…

SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an atta…

SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with admini…

SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 74…

SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send speci…

SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not suff…

SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-cont…

Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not suf…

The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modi…

Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an atta…

SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Althou…

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752…

SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the at…

SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning m…

SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31…

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 60…

SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; doe…

The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlle…

The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template…

The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and…

SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser hi…

Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS ver…

Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SA…

SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by se…

Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS ve…

VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700…

Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide…

Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error mes…

SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an…

SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source whic…

SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker t…

Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) do…

Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21…

SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to …

PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode …

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. …

Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access informati…