Skip to content
OpenAdvisories

Product · SAP

SAP Enable Now

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-39596

    [CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now

    Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be restricted. On successful exploitation, the attacker can cause limited impact on confidentiality of the application.

    SAP SAP Enable Now
  • Medium 6.5
    CVE-2024-32730

    Missing authorization check in SAP Enable Now Manager

    SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which w…

    SAP SAP Enable Now
  • Medium 6.1
    CVE-2023-36920

    Clickjacking vulnerability in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disc…

    SAP SAP Enable Now
  • Medium 5.3
    CVE-2023-36919

    Information Disclosure in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in informatio…

    SAP SAP Enable Now
  • Medium 6.1
    CVE-2023-36918

    Cross-Site Scripting vulnerability in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads t…

    SAP SAP Enable Now
  • Medium 6.1
    CVE-2023-33988

    Cross-Site Scripting vulnerability in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected…

    SAP SAP Enable Now
  • Medium 5.4
    CVE-2020-6178

    SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser hi…

    SAP SAP Enable Now