Vulnerabilities > SAP > High

DATE CVE VULNERABILITY TITLE RISK
2022-10-11 CVE-2022-41198 Out-of-bounds Write vulnerability in SAP 3D Visual Enterprise Viewer 9
Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
local
low complexity
sap CWE-787
7.8
2022-10-11 CVE-2022-41199 Out-of-bounds Write vulnerability in SAP 3D Visual Enterprise Viewer 9
Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
local
low complexity
sap CWE-787
7.8
2022-10-11 CVE-2022-41200 Out-of-bounds Write vulnerability in SAP 3D Visual Enterprise Viewer 9
Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
local
low complexity
sap CWE-787
7.8
2022-10-11 CVE-2022-41201 Out-of-bounds Write vulnerability in SAP 3D Visual Enterprise Viewer 9
Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
local
low complexity
sap CWE-787
7.8
2022-10-11 CVE-2022-41202 Out-of-bounds Write vulnerability in SAP 3D Visual Enterprise Viewer 9
Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
local
low complexity
sap CWE-787
7.8
2022-10-11 CVE-2022-41204 Open Redirect vulnerability in SAP Commerce
An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL.
network
low complexity
sap CWE-601
8.8
2022-09-13 CVE-2022-35292 Unquoted Search Path or Element vulnerability in SAP Business ONE 10.0
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges.
local
low complexity
sap CWE-428
7.8
2022-09-13 CVE-2022-39801 Improper Authentication vulnerability in SAP Access Control 12
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad.
network
high complexity
sap CWE-287
7.5
2022-08-10 CVE-2022-32245 Cleartext Transmission of Sensitive Information vulnerability in SAP Businessobjects Business Intelligence 420/430
SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network.
network
low complexity
sap CWE-319
8.2
2022-08-10 CVE-2022-35290 Unspecified vulnerability in SAP Authenticator
Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.
network
low complexity
sap
7.5