Sap vulnerabilities
1,560 vulnerabilities
Known vulnerabilities in Sap products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 544 products.
Products
50 of 544- 3D Visual Enterprise Viewer127 vulnerabilities
- Netweaver98 vulnerabilities
- Netweaver Application Server Abap86 vulnerabilities
- Businessobjects Business Intelligence Platform74 vulnerabilities
- Netweaver Application Server Java69 vulnerabilities
- Businessobjects Business Intelligence45 vulnerabilities
- Hana37 vulnerabilities
- Solution Manager33 vulnerabilities
- Business One31 vulnerabilities
- Internet Graphics Server28 vulnerabilities
- 3D Visual Enterprise Author27 vulnerabilities
- Businessobjects23 vulnerabilities
- Netweaver Abap21 vulnerabilities
- Netweaver Process Integration21 vulnerabilities
- Netweaver Enterprise Portal20 vulnerabilities
- Business Objects Business Intelligence Platform18 vulnerabilities
- Commerce Cloud18 vulnerabilities
- Hana Extended Application Services18 vulnerabilities
- Sap Basis18 vulnerabilities
- S\/4Hana17 vulnerabilities
- Disclosure Management16 vulnerabilities
- Host Agent15 vulnerabilities
- Adaptive Server Enterprise14 vulnerabilities
- Approuter13 vulnerabilities
- Enable Now13 vulnerabilities
- S4Core13 vulnerabilities
- Abap Platform12 vulnerabilities
- Customer Relationship Management Webclient Ui12 vulnerabilities
- Netweaver As Abap12 vulnerabilities
- Sap Db12 vulnerabilities
- Sap Kernel11 vulnerabilities
- Supplier Relationship Management11 vulnerabilities
- Web Dispatcher11 vulnerabilities
- Commerce10 vulnerabilities
- Customer Relationship Management10 vulnerabilities
- Netweaver As Abap Business Server Pages10 vulnerabilities
- Sap Web Application Server10 vulnerabilities
- Internet Transaction Server9 vulnerabilities
- Netweaver Application Server For Java9 vulnerabilities
- Cloud Connector8 vulnerabilities
- Hana Database8 vulnerabilities
- Landscape Management8 vulnerabilities
- Maxdb8 vulnerabilities
- Trex8 vulnerabilities
- Afaria7 vulnerabilities
- Business Connector7 vulnerabilities
- Business Warehouse7 vulnerabilities
- Crystal Reports7 vulnerabilities
- Hybris7 vulnerabilities
- Netweaver AS For ABAP And ABAP Platform7 vulnerabilities
CVE-2018-2419sap sesap enterprise financial services (ea-finserv)+5
EPSS score0.81%
SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2018-2427sapbusinessobjects_business_intelligence+3EPSS score1.72%
SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.CVE-2018-2500sapmobile_secure+1EPSS score0.31%
Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to access information which would otherwise be restricted.CVE-2018-2497saphana+1EPSS score0.93%
The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.CVE-2018-2438sapinternet_graphics_server+1EPSS score1.94%
The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.CVE-2018-2396sap sesap internet graphics server+1EPSS score0.91%
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, using IGS Interpreter service.CVE-2018-2454sapenterprise_financial_services+1EPSS score1.33%
SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2018-2485sapfiori_client+1EPSS score1.18%
It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.CVE-2018-2481sapadvanced_business_application_programming+1EPSS score1.46%
In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is used. By implementing such transaction code a malicious user may execute unauthorized transaction functionality.CVE-2018-2491sapfiori_client+1EPSS score0.79%
When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually run inside the built-in log viewer of the application in case user opens the viewer and taps on the hyperlink in the viewer. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.CVE-2018-2457sapadaptive_server_enterprise+1EPSS score0.87%
Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherwise be restricted.CVE-2018-2362sap sesap hana+1EPSS score1.58%
A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname.CVE-2018-2465saphana+1EPSS score2.56%
SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hacker can cause the database server to crash.CVE-2018-2369sap sesap hana+1EPSS score1.49%
Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the SAP HANA server on its SQL interface and disclose 8 bytes of the server process memory. The attacker cannot influence or predict the location of the leaked memory.CVE-2018-2363sap_sesap netweaver+2EPSS score1.67%
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.CVE-2018-2377sap sesap hana extended application services+1EPSS score0.85%
In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users.CVE-2018-2476sapnetweaver+1EPSS score0.96%
Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.CVE-2018-2446sapbusinessobjects_business_intelligence+1EPSS score1.72%
Admin tools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allow an unauthenticated user to read sensitive information (server name), hence leading to an information disclosure.CVE-2018-2417sap_sesap identity management+1EPSS score1.26%
Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted.CVE-2018-2418sap sesap maxdb odbc driver+1EPSS score1.73%
SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.