Vulnerabilities > SAP
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-28 | CVE-2023-40307 | Unspecified vulnerability in SAP Privileges An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow resulting in a crash of the application. | 7.8 |
| 2023-09-12 | CVE-2023-40309 | Unspecified vulnerability in SAP products SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. | 9.8 |
| 2023-09-12 | CVE-2023-40621 | Unspecified vulnerability in SAP Powerdesigner 16.7 SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. | 6.3 |
| 2023-09-12 | CVE-2023-40622 | Unspecified vulnerability in SAP Businessobjects Business Intelligence 420/430 SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. | 9.9 |
| 2023-09-12 | CVE-2023-40623 | Unspecified vulnerability in SAP Businessobjects 420/430 SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. | 7.1 |
| 2023-09-12 | CVE-2023-40624 | Unspecified vulnerability in SAP Netweaver Application Server Abap SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. | 5.4 |
| 2023-09-12 | CVE-2023-40625 | Unspecified vulnerability in SAP S4Core S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. | 5.4 |
| 2023-09-12 | CVE-2023-37489 | Unspecified vulnerability in SAP Businessobjects Business Intelligence 430 Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity. | 5.3 |
| 2023-09-12 | CVE-2023-40308 | Unspecified vulnerability in SAP products SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. | 7.5 |
| 2023-09-12 | CVE-2023-41367 | Unspecified vulnerability in SAP Netweaver 7.50 Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. | 5.3 |