Vulnerabilities in SAP
159 resultsCVE-2017-16690—A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It iEPSS 1.1%CVE-2018-2441—Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNELEPSS 1.0%CVE-2021-21316MEDIUMArbitrary code execution in less-openui5EPSS 1.0%CVE-2023-27500CRITICALDirectory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 1.0%CVE-2023-27269CRITICALDirectory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformEPSS 1.0%CVE-2023-27501HIGHDirectory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform EPSS 1.0%CVE-2018-2466—In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inpuEPSS 1.0%CVE-2018-2486—SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-SitEPSS 1.0%CVE-2018-2476—Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.EPSS 1.0%CVE-2017-16685—Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insEPSS 1.0%CVE-2017-16681—Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as userEPSS 1.0%CVE-2018-2432—SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to inEPSS 1.0%CVE-2023-25616CRITICALCode Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)EPSS 0.9%CVE-2023-25617CRITICALOS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)EPSS 0.9%CVE-2018-2497—The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntaxEPSS 0.9%CVE-2022-41264HIGHDue to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 7EPSS 0.9%CVE-2018-2483—HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMCEPSS 0.9%CVE-2018-2489—Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client vEPSS 0.9%CVE-2017-16678—Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.EPSS 0.9%CVE-2017-16679—URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7EPSS 0.9%