SAP SE vulnerabilities, page 4

1,421 vulnerabilities

Known vulnerabilities in SAP SE products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 777 products.

8.8HighCVE-2018-2412sap se · sap disclosure management +1 moresap se sap disclosure managementSAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.EPSS1.36%6.5MediumCVE-2018-2374sap se · sap hana extended application services +1 moresap se sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space.EPSS1.17%8.8HighCVE-2018-2381sap se · sap erp financials information system +1 moresap se sap erp financials information systemSAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.EPSS1.24%9.8CriticalCVE-2018-2424sap_se · sap hana database +8 moresap_se sap hana databaseSAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00EPSS2.28%7.5HighCVE-2018-2393sap se · sap internet graphics server +1 moresap se sap internet graphics serverUnder certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.EPSS15.46%9.8CriticalCVE-2018-2404sap se · sap disclosure management +1 moresap se sap disclosure managementSAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.EPSS1.85%9.8CriticalCVE-2018-2368sap se · sap netweaver system landscape directory, lm-core +1 moresap se sap netweaver system landscape directory, lm-coreSAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity.EPSS2.50%6.5MediumCVE-2018-2379sap se · sap hana extended application services +1 moresap se sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint.EPSS0.89%5.4MediumCVE-2018-2405sap_se · sap solution manager +1 moresap_se sap solution managerSAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting.EPSS0.92%9.8CriticalCVE-2018-2420sap se · sap internet graphics server (igs) +1 moresap se sap internet graphics server (igs)SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format validation.EPSS1.49%6.6MediumCVE-2018-2380sap se · sap crm +1 moresap se sap crmSAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.KEVRansomwareEPSS28.93%5.7MediumCVE-2018-2389sap se · sap internet graphics server +1 moresap se sap internet graphics serverUnder certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important information in the log file.EPSS0.70%8.1HighCVE-2018-2376sap se · sap hana extended application services +1 moresap se sap hana extended application servicesIn SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.EPSS0.92%4.7MediumCVE-2018-2415sap se · sap netweaver application server (engine api) +3 moresap se sap netweaver application server (engine api)SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.EPSS1.10%7.5HighCVE-2018-2421sap se · sap internet graphics server (igs) +1 moresap se sap internet graphics server (igs)SAP Internet Graphics Server (IGS) Portwatcher, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.EPSS2.39%5.4MediumCVE-2018-2397sap_se · sap business objects business intelligence platform +1 moresap_se sap business objects business intelligence platformIn SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controlled inputs which results in Cross-Site Scripting.EPSS0.92%7.5HighCVE-2018-2398sap se · sap business client +1 moresap se sap business clientUnder certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted.EPSS0.99%6.1MediumCVE-2018-2383sap se · sap internet graphics server +1 moresap se sap internet graphics serverReflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.EPSS0.64%8.8HighCVE-2018-2361sap_se · sap solution manager +1 moresap_se sap solution managerIn SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for configuring the BPO tools.EPSS1.24%5.4MediumCVE-2018-2410sap_se · sap business one +1 moresap_se sap business oneSAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.EPSS0.92%