Vulnerabilidades em SAP SE
778 resultadosAnálise Vexday
Com 778 CVEs catalogadas, o portfólio da SAP SE apresenta uma taxa de exploração ativa 1,7 vez acima da média geral do catálogo CISA KEV, indicando que vulnerabilidades nessa plataforma atraem atenção proporcional de agentes de ameaça. O tipo de falha mais recorrente é CWE-119 (erros de manipulação de memória), um vetor historicamente associado a impacto elevado de execução de código. A CVE mais crítica em exploração ativa, CVE-2020-6287, — neste caso CVE-2020-6207 — registra EPSS de 0,9838, sinalizando probabilidade muito alta de exploração observada na prática e justificando priorização imediata de remediação. Além disso, 18 vulnerabilidades possuem PoC pública e 46 são de severidade crítica, ampliando a superfície de risco para organizações que ainda não aplicaram os patches correspondentes.
CVE-2019-0298—SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSEPSS 1.3%CVE-2019-0281—SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulEPSS 1.3%CVE-2021-27634HIGHSAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.EPSS 1.3%CVE-2021-27610CRITICALSAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create informatEPSS 1.3%CVE-2020-6238CRITICALSAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading toEPSS 1.3%CVE-2021-40500—SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missEPSS 1.3%CVE-2020-26823CRITICALSAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatEPSS 1.3%CVE-2020-26824CRITICALSAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatEPSS 1.3%CVE-2020-26822CRITICALSAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatEPSS 1.3%CVE-2021-38178—The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 7EPSS 1.3%CVE-2022-27671—A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.EPSS 1.3%CVE-2021-27591MEDIUMWhen a user opens manipulated Portable Document Format (.PDF) format files received from untrusted sources in SAP 3D Visual Enterprise VieweEPSS 1.3%CVE-2021-27586MEDIUMWhen a user opens manipulated Interchange File Format (.IFF) format files received from untrusted sources in SAP 3D Visual Enterprise ViewerEPSS 1.3%CVE-2021-27588MEDIUMWhen a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the applicatioEPSS 1.3%CVE-2021-27589MEDIUMWhen a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise VieweEPSS 1.3%CVE-2021-27590MEDIUMWhen a user opens manipulated Tag Image File Format (.TIFF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer EPSS 1.3%CVE-2019-0247—SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could theEPSS 1.3%CVE-2021-38176CRITICALDue to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed inEPSS 1.3%CVE-2018-2417MEDIUMUnder certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwEPSS 1.3%CVE-2018-2399MEDIUMCross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of uEPSS 1.3%