Vulnerabilidades em SAP SE
778 resultadosAnálise Vexday
Com 778 CVEs catalogadas, o portfólio da SAP SE apresenta uma taxa de exploração ativa 1,7 vez acima da média geral do catálogo CISA KEV, indicando que vulnerabilidades nessa plataforma atraem atenção proporcional de agentes de ameaça. O tipo de falha mais recorrente é CWE-119 (erros de manipulação de memória), um vetor historicamente associado a impacto elevado de execução de código. A CVE mais crítica em exploração ativa, CVE-2020-6287, — neste caso CVE-2020-6207 — registra EPSS de 0,9838, sinalizando probabilidade muito alta de exploração observada na prática e justificando priorização imediata de remediação. Além disso, 18 vulnerabilidades possuem PoC pública e 46 são de severidade crítica, ampliando a superfície de risco para organizações que ainda não aplicaram os patches correspondentes.
CVE-2020-6227MEDIUMSAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP pacEPSS 0.9%CVE-2020-6187MEDIUMSAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input fEPSS 0.9%CVE-2022-32247—SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unautheEPSS 0.9%CVE-2022-41259MEDIUMSAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server EPSS 0.9%CVE-2021-33708HIGHDue to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges.EPSS 0.9%CVE-2018-2378—In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource EPSS 0.9%CVE-2018-2387—A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on EPSS 0.9%CVE-2018-2372—A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentialiEPSS 0.9%CVE-2018-2382—A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a coEPSS 0.9%CVE-2018-2377—In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized useEPSS 0.9%CVE-2021-40497—SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read senEPSS 0.9%CVE-2021-27617MEDIUMThe Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently valiEPSS 0.8%CVE-2021-27618MEDIUMThe Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file tyEPSS 0.8%CVE-2020-6177MEDIUMSAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partiEPSS 0.8%CVE-2020-6242CRITICALSAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on thEPSS 0.8%CVE-2019-0337—Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-contEPSS 0.8%CVE-2019-0308—An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price oEPSS 0.8%CVE-2021-33680MEDIUMSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes bufferEPSS 0.8%CVE-2022-28770—Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a EPSS 0.8%CVE-2021-27599MEDIUMSAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, EPSS 0.8%