Vulnerabilities > SAP

DATE CVE VULNERABILITY TITLE RISK
2020-07-14 CVE-2020-6281 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.2
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting.
network
low complexity
sap CWE-79
6.1
2020-07-14 CVE-2020-6280 Unspecified vulnerability in SAP Abap Platform and Netweaver Application Server Abap
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure.
network
low complexity
sap
2.7
2020-07-14 CVE-2020-6278 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.1/4.2
SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting
network
low complexity
sap CWE-79
5.4
2020-07-14 CVE-2020-6276 Cross-site Scripting vulnerability in SAP Businessobjects Business Intelligence Platform 4.2
SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.
network
low complexity
sap CWE-79
6.1
2020-07-14 CVE-2020-6267 Incorrect Permission Assignment for Critical Resource vulnerability in SAP Disclosure Management 10.1
Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.
network
low complexity
sap CWE-732
5.4
2020-07-01 CVE-2020-6261 Improper Encoding or Escaping of Output vulnerability in SAP Solution Manager 7.20
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation.
network
low complexity
sap CWE-116
5.3
2020-06-10 CVE-2020-6275 Server-Side Request Forgery (SSRF) vulnerability in SAP Netweaver Application Server Abap
SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server.
network
low complexity
sap CWE-918
critical
9.8
2020-06-10 CVE-2020-6271 XML Injection (aka Blind XPath Injection) vulnerability in SAP Solution Manager 7.2
SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data (files visible for technical administration users of the diagnostics agent).
network
low complexity
sap CWE-91
8.2
2020-06-10 CVE-2020-6270 Missing Authorization vulnerability in SAP Netweaver Application Server Abap
SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user leading to wrong prices.
network
low complexity
sap CWE-862
6.5
2020-06-10 CVE-2020-6269 Unspecified vulnerability in SAP Businessobjects Business Intelligence Platform 4.2
Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.
network
low complexity
sap
6.5