Vulnerabilities > SAP > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-12-12 | CVE-2023-49584 | HTTP Request Smuggling vulnerability in SAP Fiori Launchpad SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application. | 4.3 |
| 2023-12-12 | CVE-2023-49587 | Command Injection vulnerability in SAP Solution Manager 720 SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network. | 6.4 |
| 2023-12-12 | CVE-2023-42476 | Cross-site Scripting vulnerability in SAP Businessobjects web Intelligence 420 SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. | 6.8 |
| 2023-12-12 | CVE-2023-42479 | Cross-site Scripting vulnerability in SAP Biller Direct 635/750 An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. | 6.1 |
| 2023-12-12 | CVE-2023-49058 | Path Traversal vulnerability in SAP Master Data Governance SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. | 5.3 |
| 2023-11-14 | CVE-2023-41366 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in SAP Netweaver Application Server Abap Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT, allows an unauthenticated attacker to access the unintended data due to the lack of restrictions applied which may lead to low impact in confidentiality and no impact on the integrity and availability of the application. | 5.3 |
| 2023-11-14 | CVE-2023-42480 | Improper Restriction of Excessive Authentication Attempts vulnerability in SAP Netweaver Application Server Java 7.50 The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability. | 5.3 |
| 2023-10-30 | CVE-2023-36920 | Improper Restriction of Rendered UI Layers or Frames vulnerability in SAP products In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information. | 6.1 |
| 2023-10-10 | CVE-2023-41365 | XXE vulnerability in SAP Business ONE 10.0 SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. | 4.3 |
| 2023-10-10 | CVE-2023-42473 | Missing Authorization vulnerability in SAP S/4Hana 106 S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application. | 5.4 |