Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,736

Export CSV
CVE-2023-30741

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform

Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Businessobjects Business Intelligence
CVE-2023-28762

Information Disclosure in SAP BusinessObjects Intelligence Platform

SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate any user on the platform resulting into accessing and modifying data. The attacker can also make the system partially or entirely unavailable.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Businessobjects Business Intelligence
CVE-2023-29188

Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker with user level access can read and modify some sensitive information but cannot delete the data.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Customer Relationship Management Webclient Ui S4fnd Sapscore
CVE-2024-39600

[CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows

Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of the password and impersonate the affected user. As a result, it has a high impact on the confidentiality but there is no impact on the integrity and availability.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Gui For Windows
CVE-2023-2827

Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital

SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. Therefore, unauthorized callers from the internal network could send service requests to PCo or the Production Connector, which could have an impact on the integrity of the integration with SAP Digital Manufacturing.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Digital Manufacturing Plant Connectivity
CVE-2023-32114

Denial of Service in SAP NetWeaver

SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-32115

SQL Injection in Master Data Synchronization (MDS COMPARE TOOL)

An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional information persisted by the system.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Master Data Synchronization
CVE-2023-33984

Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)

SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-33985

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-33986

Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)

SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Customer Relationship Management Abap
CVE-2023-33991

Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management

SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Ui
CVE-2024-42375

Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Business Objects Business Intelligence Platform
CVE-2024-41731

Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Business Objects Business Intelligence Platform
CVE-2024-28166

Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Business Objects Business Intelligence Platform
CVE-2023-33987

Request smuggling and request concatenation in SAP Web Dispatcher

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Web Dispatcher
CVE-2023-49587

Command Injection vulnerability in SAP Solution Manager

SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Solution Manager
CVE-2024-39598

[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)

SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Customer Relationship Management S4fnd Customer Relationship Management Webclient Ui
CVE-2024-39593

[CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management

SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Landscape Management
CVE-2024-39592

[CVE-2024-39592] Missing Authorization check in SAP PDCE

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
S4core S4coreop Sap Pdce
CVE-2024-37176

Missing Authorization check in SAP BW/4HANA Transformation and DTP

SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Bw\/4hana