Vulnerabilidades em SAP SE
778 resultadosAnálise Vexday
Com 778 CVEs catalogadas, o portfólio da SAP SE apresenta uma taxa de exploração ativa 1,7 vez acima da média geral do catálogo CISA KEV, indicando que vulnerabilidades nessa plataforma atraem atenção proporcional de agentes de ameaça. O tipo de falha mais recorrente é CWE-119 (erros de manipulação de memória), um vetor historicamente associado a impacto elevado de execução de código. A CVE mais crítica em exploração ativa, CVE-2020-6287, — neste caso CVE-2020-6207 — registra EPSS de 0,9838, sinalizando probabilidade muito alta de exploração observada na prática e justificando priorização imediata de remediação. Além disso, 18 vulnerabilidades possuem PoC pública e 46 são de severidade crítica, ampliando a superfície de risco para organizações que ainda não aplicaram os patches correspondentes.
CVE-2019-0305—Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, EPSS 0.9%CVE-2019-0254—SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site ScriEPSS 0.9%CVE-2022-26108—When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - versionEPSS 0.9%CVE-2022-22537—When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise ViewerEPSS 0.9%CVE-2019-0399—SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allowEPSS 0.9%CVE-2020-6243HIGHUnder certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessarEPSS 0.9%CVE-2020-6189MEDIUMCertain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give eEPSS 0.9%CVE-2022-29619—Under certain conditions SAP BusinessObjects Business Intelligence Platform 4.x - versions 420,430 allows user Administrator to view, edit oEPSS 0.9%CVE-2019-0380—Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values tEPSS 0.9%CVE-2021-27623MEDIUMSAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing sEPSS 0.9%CVE-2021-27603MEDIUMAn RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for anEPSS 0.9%CVE-2020-6227MEDIUMSAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP pacEPSS 0.9%CVE-2019-0308—An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price oEPSS 0.9%CVE-2020-6187MEDIUMSAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input fEPSS 0.9%CVE-2021-33708HIGHDue to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges.EPSS 0.9%CVE-2018-2377—In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized useEPSS 0.9%CVE-2018-2382—A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a coEPSS 0.9%CVE-2018-2378—In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource EPSS 0.9%CVE-2018-2372—A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentialiEPSS 0.9%CVE-2018-2387—A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on EPSS 0.9%