Vulnerabilidades em SAP SE
778 resultadosAnálise Vexday
Com 778 CVEs catalogadas, o portfólio da SAP SE apresenta uma taxa de exploração ativa 1,7 vez acima da média geral do catálogo CISA KEV, indicando que vulnerabilidades nessa plataforma atraem atenção proporcional de agentes de ameaça. O tipo de falha mais recorrente é CWE-119 (erros de manipulação de memória), um vetor historicamente associado a impacto elevado de execução de código. A CVE mais crítica em exploração ativa, CVE-2020-6287, — neste caso CVE-2020-6207 — registra EPSS de 0,9838, sinalizando probabilidade muito alta de exploração observada na prática e justificando priorização imediata de remediação. Além disso, 18 vulnerabilidades possuem PoC pública e 46 são de severidade crítica, ampliando a superfície de risco para organizações que ainda não aplicaram os patches correspondentes.
CVE-2021-37532MEDIUMSAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conteEPSS 0.8%CVE-2020-6315MEDIUMSAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of EPSS 0.8%CVE-2022-35290HIGHUnder certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.EPSS 0.8%CVE-2019-0332—SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword EPSS 0.8%CVE-2019-0335—Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an EPSS 0.8%CVE-2020-6302MEDIUMSAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. AEPSS 0.8%CVE-2020-6270MEDIUMSAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authoEPSS 0.8%CVE-2022-35293CRITICALDue to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploiEPSS 0.8%CVE-2022-24398—Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to accessEPSS 0.8%CVE-2022-31595—SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalatiEPSS 0.8%CVE-2022-29611—SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resultiEPSS 0.8%CVE-2019-0311—Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode uEPSS 0.8%CVE-2020-6201MEDIUMThe SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to whicEPSS 0.8%CVE-2019-0303—SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting EPSS 0.8%CVE-2020-6213MEDIUMSAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754,EPSS 0.8%CVE-2021-33686MEDIUMUnder certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive informaEPSS 0.8%CVE-2021-38179—Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contentsEPSS 0.8%CVE-2020-6209HIGHSAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to adminEPSS 0.8%CVE-2021-21487MEDIUMSAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilEPSS 0.8%CVE-2021-21467MEDIUMSAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalatioEPSS 0.8%