Skip to contentSap vulnerabilities
Products
Show 140 moreShow less
Newest
- sap internet graphics serverUnder certain conditions a malicious user provoking an out of bounds buffer overflow can prevent...CVE-2018-23866.5 Medium
- sap internet graphics serverUnder certain conditions a malicious user provoking a divide by zero crash can prevent legitimate...CVE-2018-23856.5 Medium
- sap internet graphics serverUnder certain conditions a malicious user provoking a Null Pointer dereference can prevent...CVE-2018-23846.5 Medium
- sap internet graphics serverReflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45...CVE-2018-23836.1 Medium
- sap internet graphics serverA vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow...CVE-2018-23826.5 Medium
- sap erp financials information systemSAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN...CVE-2018-23818.8 High
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given...CVE-2018-23796.5 Medium
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data...CVE-2018-23786.5 Medium
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, some general server statistics and status...CVE-2018-23776.5 Medium
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor...CVE-2018-23768.1 High
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor...CVE-2018-23758.1 High
- sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor...CVE-2018-23746.5 Medium
- sap hana extended application servicesUnder certain circumstances, a specific endpoint of the Controller's API could be misused by...CVE-2018-23737.5 High
- sap hana extended application servicesA plain keystore password is written to a system log file in SAP HANA Extended Application...CVE-2018-23726.5 Medium
- sap netweaver java web applicationThe SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not...CVE-2018-23716.1 Medium
- sap bi launchpadServer Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad...CVE-2018-23705.3 Medium
- sap hanaUnder certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access...CVE-2018-23695.3 Medium
- sap s4fnd, sap se crm webclient ui, sap customer relationship management webclient ui +2 moreSAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently...CVE-2018-23646.1 Medium
- sap netweaver, business application software integrated solution +1 moreSAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7...CVE-2018-23638.8 High
- sap hanaA remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP...CVE-2018-23625.3 Medium
- sap solution managerIn SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO)...CVE-2018-23618.8 High
- sap kernel, sap se startup service +1 moreSAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for...CVE-2018-23607.5 High
- sap note assistant, business application software integrated solution +1 moreSAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7...CVE-2017-166916.5 Medium
- sap plant connectivityA malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program...CVE-2017-166907.8 High
- sap kernel, trusted rfc connection +1 moreA Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL...CVE-2017-166898.8 High
- sap hana database, hana extended application services +1 moreThe user self-service tools of SAP HANA extended application services, classic user self-service,...CVE-2017-166875.3 Medium
- sap business warehouse universal data integrationCross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7...CVE-2017-166856.1 Medium
- sap business intelligence promotion management applicationSAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does...CVE-2017-166849.8 Critical
- sap business objects platform, businessobjects +1 moreDenial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could...CVE-2017-166836.5 Medium
- sap netweaver internet transaction server, netweaver internet transaction server (its), business application software integrated solution +2 moreSAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40,...CVE-2017-166827.2 High
- sap business intelligence promotion management application, business intelligence promotion management application. +1 moreCross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management...CVE-2017-166816.1 Medium
- sap hana extended application servicesTwo potential audit log injections in SAP HANA extended application services 1.0, advanced model:...CVE-2017-166807.5 High
- sap startup service, kernel +1 moreURL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode,...CVE-2017-166796.1 Medium
- sap epbc, epbc2, kmc-bc +1 more +3 moreServer Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management...CVE-2017-166784.7 Medium
- sap businessobjects financial consolidationCross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06...CVE-2017-145166.1 Medium
- sap host agentSAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP...CVE-2017-152977.5 High
- sap customer relationship managementThe Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.CVE-2017-152968.8 High
- sap point of sale xpress serverXpress Server in SAP POS does not require authentication for read/write/delete file access. This...CVE-2017-152959.8 Critical
- sap customer relationship managementThe Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.CVE-2017-152946.1 Medium
- sap point of sale xpress serverXpress Server in SAP POS does not require authentication for file read and erase operations,...CVE-2017-152939.8 Critical
- sap enterprise portalCross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to...CVE-2017-107016.1 Medium
- sap netweaver application server javaThe Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to...CVE-2017-145817.5 High
- sap e-recruitingAn issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external...CVE-2017-145117.5 High
- sap netweaverXML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.CVE-2015-7241Public exploitEPSS 13.5%9.8 Critical
- sap hybrisDirectory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3...CVE-2014-88717.5 High
- sap netweaver, netweaver application server java +1 moreDirectory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP...CVE-2017-12637In KEVPublic exploitEPSS 95.1%7.5 High
- sap netweaver portalCross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver...CVE-2017-114606.1 Medium
- sap trexSAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2)...CVE-2017-114599.8 Critical
- sap netweaver application server javaCross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS...CVE-2017-114586.1 Medium
- sap netweaver application server javaXML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows...CVE-2017-114576.5 Medium
- Show moreLoading…