SAP SE vulnerabilities, page 5
1,421 vulnerabilities
Known vulnerabilities in SAP SE products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 777 products.
MediumCVE-2018-2428sap se · sap infrastructure +4 moresap se sap infrastructureUnder certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00.EPSS1.68%HighCVE-2018-2423sap se · sap internet graphics server (igs) +1 moresap se sap internet graphics server (igs)SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, HTTP and RFC listener allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.EPSS2.39%MediumCVE-2021-21464sap se · sap 3d visual enterprise viewer +1 moresap se sap 3d visual enterprise viewerSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.EPSS1.04%CriticalCVE-2021-21479Mavencom.sap.scimono · scimono-server +2 morecom.sap.scimono scimono-serverIn SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.EPSS10.12%HighCVE-2021-21455sap se · sap 3d visual enterprise viewer +1 moresap se sap 3d visual enterprise viewerSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.EPSS1.21%CriticalCVE-2021-21465sap se · sap business warehouse +1 moresap se sap business warehouseThe BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection vulnerability which can fully compromise the affected SAP system.EPSS3.72%MediumCVE-2021-21448sap_se · sap gui for windows +1 moresap_se sap gui for windowsSAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on the client PC and not via Network and the attacker needs at least user authorization of the Operating System user of the victim.EPSS0.29%MediumCVE-2021-21447sap_se · sap businessobjects business intelligence platform (web intelligence html interface) +1 moresap_se sap businessobjects business intelligence platform (web intelligence html interface)SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed by User who views the relevant application content, which leads to Stored Cross-Site Scripting.EPSS0.54%MediumCVE-2021-21470sap se · sap epm add-in for microsoft office +2 moresap se sap epm add-in for microsoft officeSAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configuration files. This occurs as logging service does not disable XML external entities when parsing configuration files and a successful exploit would result in limited impact on integrity and availability of the application.EPSS0.24%MediumCVE-2021-21488sap se · sap netweaver (knowledge management) +1 moresap se sap netweaver (knowledge management)Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.EPSS1.34%MediumCVE-2021-21471sap_se · cla-assistant +1 moresap_se cla-assistantIn CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.EPSS0.74%MediumCVE-2021-21444sap se · sap business objects business intelligence platform (cmc and bi launchpad) +1 moresap se sap business objects business intelligence platform (cmc and bi launchpad)SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.EPSS0.81%HighCVE-2021-21482sap se · sap netweaver master data management +1 moresap se sap netweaver master data managementSAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges leading to information disclosure vulnerability thereby affecting the confidentiality and integrity of the application. This happens when security guidelines and recommendations concerning administrative accounts of an SAP NetWeaver Master Data Management installation have not been thoroughly reviewed.EPSS0.42%CriticalCVE-2021-21481sap se · sap netweaver as java (migrationservice) +1 moresap se sap netweaver as java (migrationservice)The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability.EPSS0.51%CriticalCVE-2021-21477sap_se · sap commerce +1 moresap_se sap commerceSAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality, integrity and availability of the application.EPSS29.85%HighCVE-2021-21458sap se · sap 3d visual enterprise viewer +1 moresap se sap 3d visual enterprise viewerSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.EPSS1.21%HighCVE-2021-21454sap se · sap 3d visual enterprise viewer +1 moresap se sap 3d visual enterprise viewerSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.EPSS1.21%HighCVE-2021-21463sap se · sap 3d visual enterprise viewer +1 moresap se sap 3d visual enterprise viewerSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.EPSS1.21%HighCVE-2021-21460sap se · sap 3d visual enterprise viewer +1 moresap se sap 3d visual enterprise viewerSAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.EPSS1.21%MediumCVE-2021-21467sap se · sap banking services (generic market data) +1 moresap se sap banking services (generic market data)SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. An unauthorized User is allowed to display restricted Business Partner Generic Market Data (GMD), due to improper authorization check.EPSS0.79%