Vulnerabilities > SAP

DATE CVE VULNERABILITY TITLE RISK
2022-02-09 CVE-2022-22533 Unspecified vulnerability in SAP Netweaver Application Server Java
Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could submit multiple HTTP server requests resulting in errors, such that it consumes the memory buffer.
network
low complexity
sap
7.5
2022-02-09 CVE-2022-22534 Cross-site Scripting vulnerability in SAP Netweaver
Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password.
network
low complexity
sap CWE-79
6.1
2022-02-09 CVE-2022-22535 Unspecified vulnerability in SAP ERP Human Capital Management 600/604/608
SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area.
network
low complexity
sap
6.5
2022-02-09 CVE-2022-22536 Unspecified vulnerability in SAP products
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation.
network
low complexity
sap
critical
10.0
2022-02-09 CVE-2022-22537 Unspecified vulnerability in SAP 3D Visual Enterprise Viewer 9
When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
network
low complexity
sap
6.5
2022-02-09 CVE-2022-22538 Improper Input Validation vulnerability in SAP 3D Visual Enterprise Viewer 9
When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
network
low complexity
sap CWE-20
6.5
2022-02-09 CVE-2022-22539 Unspecified vulnerability in SAP 3D Visual Enterprise Viewer 9
When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
network
low complexity
sap
6.5
2022-02-09 CVE-2022-22540 Unspecified vulnerability in SAP Netweaver Application Server Abap
SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database.
network
low complexity
sap
7.5
2022-02-09 CVE-2022-22542 Unspecified vulnerability in SAP S/4Hana 104/105/106
S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects exposes the private address fields of Employee Business Partners, to an actor that is not explicitly authorized to have access to that information, which could compromise Confidentiality.
network
low complexity
sap
6.5
2022-02-09 CVE-2022-22543 Unspecified vulnerability in SAP Netweaver Abap and Netweaver AS Abap
SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-passport information, which could lead to a Denial-of-Service attack.
network
low complexity
sap
7.5