Vulnerabilities > SAP > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-09-15 | CVE-2021-33701 | SQL Injection vulnerability in SAP Dmis, S4Core and Sapscore DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability. | 6.5 |
| 2021-09-15 | CVE-2021-33704 | Missing Authorization vulnerability in SAP Business ONE 10.0 The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. | 6.5 |
| 2021-09-15 | CVE-2021-33705 | Server-Side Request Forgery (SSRF) vulnerability in SAP Netweaver Portal The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. | 5.8 |
| 2021-09-14 | CVE-2021-33673 | Cross-site Scripting vulnerability in SAP Contact Center 700 Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. | 4.3 |
| 2021-09-14 | CVE-2021-33674 | Cross-site Scripting vulnerability in SAP Contact Center 700 Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. | 4.3 |
| 2021-09-14 | CVE-2021-33675 | Cross-site Scripting vulnerability in SAP Contact Center 700 Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. | 4.3 |
| 2021-09-14 | CVE-2021-33685 | Path Traversal vulnerability in SAP Business ONE 10.0 SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restricted directory. | 4.0 |
| 2021-09-14 | CVE-2021-33686 | Unspecified vulnerability in SAP Business ONE 10.0 Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over kind or degree. | 5.0 |
| 2021-09-14 | CVE-2021-33688 | SQL Injection vulnerability in SAP Business ONE 10.0 SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. | 4.0 |
| 2021-09-14 | CVE-2021-37532 | Path Traversal vulnerability in SAP Business ONE 10.0 SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be restricted to high privileged User. | 4.0 |