Vulnerabilities > SAP
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2009-09-24 | CVE-2009-3346 | Remote Security vulnerability in SAP Crystal Reports Server 2008 Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. | 10.0 |
| 2009-09-24 | CVE-2009-3345 | Buffer Errors vulnerability in SAP Crystal Reports Server 2008 Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. | 10.0 |
| 2009-09-24 | CVE-2009-3344 | Remote vulnerability in SAP Crystal Reports Server 2008 Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service (infinite loop) via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. | 5.0 |
| 2009-08-21 | CVE-2009-2932 | Cross-Site Scripting vulnerability in SAP Netweaver 7.0 Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field. | 4.3 |
| 2009-04-16 | CVE-2008-4830 | Remote Code Execution vulnerability in SAP AG SAPgui KWEdit ActiveX Control Insecure Method Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files via the OpenDocument method. | 9.3 |
| 2009-04-01 | CVE-2007-4475 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in SAP Sapgui Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method. | 9.3 |
| 2009-01-28 | CVE-2008-3358 | Cross-Site Scripting vulnerability in SAP Netweaver Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document. | 4.3 |
| 2009-01-08 | CVE-2008-4827 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140, as used in ComponentOne Studio for ActiveX 2008, TSC2 Help Desk 4.1.8, SAP GUI 6.40 Patch 29 and 7.10, and possibly other products, allow remote attackers to execute arbitrary code by adding many tabs, or adding tabs with long tab captions. | 9.3 |
| 2008-11-10 | CVE-2008-4387 | Code Injection vulnerability in multiple products Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary code via unknown vectors involving instantiation by Internet Explorer. | 9.3 |
| 2008-08-01 | CVE-2008-1810 | Permissions, Privileges, and Access Controls vulnerability in SAP Maxdb 7.6.03.15 Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable. | 4.4 |