Vulnerabilities > SAP > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-02-14 | CVE-2023-24522 | Unspecified vulnerability in SAP Netweaver Application Server Abap Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. | 6.1 |
| 2023-02-14 | CVE-2023-24524 | Unspecified vulnerability in SAP S/4Hana 104/105 SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. | 6.5 |
| 2023-02-14 | CVE-2023-24525 | Unspecified vulnerability in SAP products SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. On successful exploitation an authenticated attacker can cause limited impact on confidentiality of the application. | 5.4 |
| 2023-02-14 | CVE-2023-24528 | Unspecified vulnerability in SAP Fiori 600 SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. | 6.5 |
| 2023-02-14 | CVE-2023-24529 | Unspecified vulnerability in SAP Netweaver AS Abap Business Server Pages Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a Reflected Cross-Site Scripting (XSS) attack. | 6.1 |
| 2023-02-14 | CVE-2023-25614 | Unspecified vulnerability in SAP Netweaver Application Server Abap SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code that can be executed by the application over the network. | 6.1 |
| 2023-01-10 | CVE-2023-0015 | Unspecified vulnerability in SAP Business Objects Business Intelligence Platform 420 In SAP BusinessObjects Business Intelligence Platform (Web Intelligence user interface) - version 420, some calls return json with wrong content type in the header of the response. | 5.4 |
| 2023-01-10 | CVE-2023-0018 | Unspecified vulnerability in SAP Businessobjects Business Intelligence Platform 420/430 Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. | 6.1 |
| 2023-01-10 | CVE-2023-0023 | Unspecified vulnerability in SAP Bank Account Management 800/900 In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. | 5.7 |
| 2023-01-10 | CVE-2023-0012 | Unspecified vulnerability in SAP Host Agent 7.21/7.22 In SAP Host Agent (Windows) - versions 7.21, 7.22, an attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account. | 6.7 |