Vulnerabilidades em SAP SE
778 resultadosAnálise Vexday
Com 778 CVEs catalogadas, o portfólio da SAP SE apresenta uma taxa de exploração ativa 1,7 vez acima da média geral do catálogo CISA KEV, indicando que vulnerabilidades nessa plataforma atraem atenção proporcional de agentes de ameaça. O tipo de falha mais recorrente é CWE-119 (erros de manipulação de memória), um vetor historicamente associado a impacto elevado de execução de código. A CVE mais crítica em exploração ativa, CVE-2020-6287, — neste caso CVE-2020-6207 — registra EPSS de 0,9838, sinalizando probabilidade muito alta de exploração observada na prática e justificando priorização imediata de remediação. Além disso, 18 vulnerabilidades possuem PoC pública e 46 são de severidade crítica, ampliando a superfície de risco para organizações que ainda não aplicaram os patches correspondentes.
CVE-2021-33673HIGHUnder certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This alEPSS 0.8%CVE-2022-22534—Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data lEPSS 0.8%CVE-2022-28216—SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unautEPSS 0.8%CVE-2022-24397—SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectEPSS 0.8%CVE-2022-22535—SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of eEPSS 0.8%CVE-2020-6232MEDIUMSAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization CheckEPSS 0.8%CVE-2020-6367HIGHThere is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40,EPSS 0.8%CVE-2021-40502—SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resultEPSS 0.8%CVE-2021-44233—SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated userEPSS 0.8%CVE-2021-21476MEDIUMSAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect uEPSS 0.8%CVE-2021-21444MEDIUMSAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which mEPSS 0.8%CVE-2020-26835MEDIUMSAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input maliciouEPSS 0.8%CVE-2021-27619MEDIUMSAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are nEPSS 0.8%CVE-2022-28215—SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious siEPSS 0.8%CVE-2021-27604HIGHIn order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise ServiEPSS 0.8%CVE-2022-22545—A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWEPSS 0.8%CVE-2021-38175MEDIUMSAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gatherEPSS 0.8%CVE-2020-6316MEDIUMSAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leadiEPSS 0.8%CVE-2020-26828MEDIUMSAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. EPSS 0.8%CVE-2018-2419LOWSAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perfEPSS 0.8%