SAP SE vulnerabilities, page 2

1,421 vulnerabilities

Known vulnerabilities in SAP SE products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 777 products.

5.5MediumCVE-2018-2419sap se · sap enterprise financial services (ea-finserv) +5 moresap se sap enterprise financial services (ea-finserv)SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.EPSS0.81%6.5MediumCVE-2018-2396sap se · sap internet graphics server +1 moresap se sap internet graphics serverUnder certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, using IGS Interpreter service.EPSS0.91%5.3MediumCVE-2018-2362sap se · sap hana +1 moresap se sap hanaA remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's hostname.EPSS1.58%5.3MediumCVE-2018-2369sap se · sap hana +1 moresap se sap hanaUnder certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the SAP HANA server on its SQL interface and disclose 8 bytes of the server process memory. The attacker cannot influence or predict the location of the leaked memory.EPSS1.49%4.3MediumCVE-2018-2366redwood · sap_business_process_automation +1 moreredwood sap_business_process_automationSAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.EPSS1.51%8.8HighCVE-2018-2363sap_se · sap netweaver +2 moresap_se sap netweaverSAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.EPSS1.67%6.5MediumCVE-2018-2377sap se · sap hana extended application services +1 moresap se sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users.EPSS0.85%5.3MediumCVE-2018-2417sap_se · sap identity management +1 moresap_se sap identity managementUnder certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows an attacker to access information which would otherwise be restricted.EPSS1.26%9.8CriticalCVE-2018-2418sap se · sap maxdb odbc driver +1 moresap se sap maxdb odbc driverSAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.EPSS1.73%8.8HighCVE-2018-2367sap se · sap basis (abap file interface) +1 moresap se sap basis (abap file interface)ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.EPSS1.87%6.5MediumCVE-2018-2382sap se · sap internet graphics server +1 moresap se sap internet graphics serverA vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a controlled area and as such gain information from system area, which is not available to the user otherwise.EPSS0.85%7.5HighCVE-2018-2499sap se · sap financial consolidation cube designer (bobj_eades) +2 moresap se sap financial consolidation cube designer (bobj_eades)A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash of an admin user.EPSS1.73%6.5MediumCVE-2018-2394sap se · sap internet graphics server +1 moresap se sap internet graphics serverUnder certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, services and/or system files.EPSS1.03%6.5MediumCVE-2018-2386sap se · sap internet graphics server +1 moresap se sap internet graphics serverUnder certain conditions a malicious user provoking an out of bounds buffer overflow can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53.EPSS0.98%6.1MediumCVE-2018-2388sap se · sap internet graphics server +1 moresap se sap internet graphics serverStored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.EPSS0.64%6.1MediumCVE-2018-2364sap se · s4fnd +3 moresap se s4fndSAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.EPSS0.96%6.5MediumCVE-2018-2378sap se · sap hana extended application services +1 moresap se sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption.EPSS0.85%6.1MediumCVE-2018-2399sap se · sap process monitoring infrastructure +1 moresap se sap process monitoring infrastructureCross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs.EPSS1.25%6.1MediumCVE-2018-2371sap se · sap netweaver java web application +1 moresap se sap netweaver java web applicationThe SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.EPSS0.96%7.5HighCVE-2018-2408sap_se · sap business objects +1 moresap_se sap business objectsImproper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be active.EPSS1.54%