Vulnerabilities > SAP > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-10-08 CVE-2019-0367 Missing Authorization vulnerability in SAP Netweaver Process Integration 1.0/2.0
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.
network
low complexity
sap CWE-862
4.3
2019-09-10 CVE-2019-0364 Unspecified vulnerability in SAP Hana Extended Application Services 1.0
Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate open ports.
network
low complexity
sap
4.3
2019-09-10 CVE-2019-0361 Cross-site Scripting vulnerability in SAP Supplier Relationship Management 3.73/7.31/7.32
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
network
low complexity
sap CWE-79
6.1
2019-09-10 CVE-2019-0357 Unspecified vulnerability in SAP Hana 1.0/2.0
The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges.
local
low complexity
sap
6.7
2019-09-10 CVE-2019-0356 Unspecified vulnerability in SAP Netweaver Process Integration 7.31/7.40/7.50
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
network
low complexity
sap
4.3
2019-08-14 CVE-2019-0348 Cleartext Transmission of Sensitive Information vulnerability in SAP Businessobjects Business Intelligence 4.1/4.2
SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
network
low complexity
sap CWE-319
6.5
2019-08-14 CVE-2019-0346 Cleartext Transmission of Sensitive Information vulnerability in SAP Businessobjects Business Intelligence 4.2
Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.
network
low complexity
sap CWE-319
6.5
2019-08-14 CVE-2019-0340 XXE vulnerability in SAP Enable NOW 10
The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability.
network
low complexity
sap CWE-611
5.4
2019-08-14 CVE-2019-0338 Information Exposure vulnerability in SAP Gateway
During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.
network
low complexity
sap CWE-200
5.3
2019-08-14 CVE-2019-0337 Cross-site Scripting vulnerability in SAP Netweaver Process Integration
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability
network
low complexity
sap CWE-79
6.1