Vulnerabilities > SAP > Medium

DATE CVE VULNERABILITY TITLE RISK
2022-02-09 CVE-2022-22546 Unspecified vulnerability in SAP Businessobjects web Intelligence 420
Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad) - version 420.
network
low complexity
sap
5.4
2022-01-14 CVE-2021-42067 Unspecified vulnerability in SAP Netweaver Abap and Netweaver Application Server Abap
In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see.
network
low complexity
sap
4.3
2022-01-14 CVE-2021-44234 Unspecified vulnerability in SAP Business ONE 10.0
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
local
low complexity
sap
5.5
2022-01-14 CVE-2022-22529 Cross-site Scripting vulnerability in SAP Enterprise Threat Detection 2.0
SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability.
network
low complexity
sap CWE-79
6.1
2021-12-14 CVE-2021-42061 Unspecified vulnerability in SAP Businessobjects Business Intelligence Platform 420
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap
5.4
2021-12-14 CVE-2021-42063 Cross-site Scripting vulnerability in SAP Knowledge Warehouse
A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50.
network
low complexity
sap CWE-79
6.1
2021-12-14 CVE-2021-42066 Unspecified vulnerability in SAP Business ONE 10.0
SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted.
network
high complexity
sap
4.4
2021-12-14 CVE-2021-44235 OS Command Injection vulnerability in SAP Netweaver Application Server Abap
Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder.
local
low complexity
sap CWE-78
6.7
2021-11-10 CVE-2021-40504 Incorrect Authorization vulnerability in SAP Netweaver Application Server Abap
A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.
network
low complexity
sap CWE-863
4.9
2021-11-10 CVE-2021-42062 Unspecified vulnerability in SAP ERP Human Capital Management 600/604/608
SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area.
network
low complexity
sap
4.3