Vulnerabilidades em SAP SE
778 resultadosAnálise Vexday
Com 778 CVEs catalogadas, o portfólio da SAP SE apresenta uma taxa de exploração ativa 1,7 vez acima da média geral do catálogo CISA KEV, indicando que vulnerabilidades nessa plataforma atraem atenção proporcional de agentes de ameaça. O tipo de falha mais recorrente é CWE-119 (erros de manipulação de memória), um vetor historicamente associado a impacto elevado de execução de código. A CVE mais crítica em exploração ativa, CVE-2020-6287, — neste caso CVE-2020-6207 — registra EPSS de 0,9838, sinalizando probabilidade muito alta de exploração observada na prática e justificando priorização imediata de remediação. Além disso, 18 vulnerabilidades possuem PoC pública e 46 são de severidade crítica, ampliando a superfície de risco para organizações que ainda não aplicaram os patches correspondentes.
CVE-2021-38150MEDIUMWhen an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP EPSS 0.5%CVE-2020-6250MEDIUMSAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the aEPSS 0.5%CVE-2022-24396—The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be aEPSS 0.5%CVE-2021-21481CRITICALThe MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization chEPSS 0.5%CVE-2022-41208MEDIUMDue to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to aEPSS 0.5%CVE-2022-26102—Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attackeEPSS 0.5%CVE-2021-27601MEDIUMSAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the serveEPSS 0.5%CVE-2022-22546—Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web IntEPSS 0.5%CVE-2021-38164MEDIUMSAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, EPSS 0.5%CVE-2022-39014—Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attackEPSS 0.5%CVE-2021-33679MEDIUMThe SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script EPSS 0.5%CVE-2021-33665MEDIUMSAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - EPSS 0.5%CVE-2021-33664MEDIUMSAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731EPSS 0.5%CVE-2021-33696MEDIUMSAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputEPSS 0.5%CVE-2021-42061—SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, reEPSS 0.5%CVE-2022-32244—Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) sysEPSS 0.5%CVE-2021-33694MEDIUMSAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to EPSS 0.5%CVE-2022-32246—SAP Busines Objects Business Intelligence Platform (Visual Difference Application) - versions 420, 430, allows an authenticated attacker whoEPSS 0.5%CVE-2022-41207MEDIUMSAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use EPSS 0.5%CVE-2022-41258MEDIUMDue to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious scripEPSS 0.5%