Vulnerabilities > SAP

DATE CVE VULNERABILITY TITLE RISK
2019-09-10 CVE-2019-0355 Code Injection vulnerability in SAP Netweaver Application Server Java
SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application.
network
low complexity
sap CWE-94
7.2
2019-09-10 CVE-2019-0353 Unspecified vulnerability in SAP Business ONE Client 9.2/9.3
Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted.
local
low complexity
sap
3.3
2019-09-10 CVE-2019-0352 Information Exposure vulnerability in SAP Businessobjects Business Intelligence Platform 4.10/4.20/4.30
In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.
network
low complexity
sap CWE-200
7.5
2019-08-14 CVE-2019-0349 Missing Authorization vulnerability in SAP Advanced Business Application Programming Platform Kernel
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check
network
low complexity
sap CWE-862
7.2
2019-08-14 CVE-2019-0351 Unspecified vulnerability in SAP Netweaver
A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50.
network
low complexity
sap
8.8
2019-08-14 CVE-2019-0348 Cleartext Transmission of Sensitive Information vulnerability in SAP Businessobjects Business Intelligence 4.1/4.2
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
network
low complexity
sap CWE-319
6.5
2019-08-14 CVE-2019-0346 Cleartext Transmission of Sensitive Information vulnerability in SAP Businessobjects Business Intelligence 4.2
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.
network
low complexity
sap CWE-319
6.5
2019-08-14 CVE-2019-0345 Server-Side Request Forgery (SSRF) vulnerability in SAP Netweaver Application Server Java
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.
network
low complexity
sap CWE-918
critical
9.8
2019-08-14 CVE-2019-0344 Deserialization of Untrusted Data vulnerability in SAP Commerce Cloud
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
network
low complexity
sap CWE-502
critical
9.8
2019-08-14 CVE-2019-0343 Code Injection vulnerability in SAP Commerce Cloud
SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection.
network
low complexity
sap CWE-94
8.8