Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,736

Export CSV
CVE-2024-22131

Code Injection vulnerability in SAP ABA (Application Basis)

In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions which they would not normally be permitted to perform.  Depending on the function executed, the attack can read or modify any user/business data and can make the entire system unavailable.

CVSS 3.1 · 9.1 Critical EPSS 1.1% KEV · Not listed
Vendors
Sap
Products
Abap Platform
CVE-2024-22129

Cross-Site Scripting (XSS) vulnerability in SAP Companion

SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Companion
CVE-2024-22124

Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager

Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2024-21734

URL Redirection vulnerability in SAP Marketing (Contacts App)

SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the application.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Marketing
CVE-2023-6542

Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID

Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker could navigate to arbitrary URL including application deep links on the device.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Emarsys Sdk
CVE-2023-49581

SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap
CVE-2023-49580

Information disclosure in SAP GUI for Windows and SAP GUI for Java

SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to create Layout configurations of the ABAP List Viewer and with this causing a mild impact on integrity and availability, e.g. also increasing the response times of the AS ABAP.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Graphical User Interface
CVE-2023-49578

Denial of service (DOS) in SAP Cloud Connector

SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity  of the application.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Cloud Connector
CVE-2023-49577

Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)

The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Human Capital Management
CVE-2023-49058

Directory Traversal vulnerability in SAP Master Data Governance

SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Master Data Governance
CVE-2023-42481

Improper Access Control vulnerability in SAP Commerce Cloud

In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Commerce Cloud
CVE-2023-42480

Information Disclosure in NetWeaver AS Java Logon

The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2023-42478

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Business Objects Business Intelligence Platform
CVE-2023-42477

Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)

SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2023-42476

Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Businessobjects Web Intelligence
CVE-2023-42475

Information Disclosure Vulnerability in Statutory Reporting

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
S\/4hana
CVE-2023-42474

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence

SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Businessobjects Web Intelligence
CVE-2023-42472

Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image file, an authenticated attacker could intercept the request, modify the content type and the extension to read and modify sensitive data causing a high impact on confidentiality and integrity of the application.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Businessobjects Business Intelligence Platform
CVE-2023-41369

External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
S\/4 Hana
CVE-2023-41368

Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)

The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
S\/4 Hana