Vulnerabilities in SAP SE
778 resultsCVE-2022-22547—Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted EPSS 2.5%CVE-2018-2368—SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalitiEPSS 2.5%CVE-2019-0274—SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service EPSS 2.4%CVE-2018-2421MEDIUMSAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessiEPSS 2.4%CVE-2018-2423MEDIUMSAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users frEPSS 2.4%CVE-2019-0345—A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versEPSS 2.3%CVE-2018-2424CRITICALSAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being adEPSS 2.3%CVE-2020-26838CRITICALSAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows aEPSS 2.2%CVE-2022-27668—Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to executeEPSS 2.2%CVE-2019-0268—SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML documenEPSS 2.2%CVE-2020-26836LOWSAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulneEPSS 2.2%CVE-2020-26832HIGHSAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2EPSS 2.2%CVE-2019-0330—The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attEPSS 2.1%CVE-2019-0277—SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated deEPSS 2.1%CVE-2019-0403—SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading toEPSS 2.1%CVE-2021-33701CRITICALDMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1EPSS 2.1%CVE-2021-27602CRITICALSAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which aEPSS 2.1%CVE-2020-26809MEDIUMSAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/mediEPSS 2.1%CVE-2021-33705HIGHThe SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request ForgerEPSS 2.1%CVE-2019-0327—SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2EPSS 2.1%