Browse CVEs

MEDIUM 6.5 CVE-2022-28217 Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an a… Netweaver No fix yet Fix from $1,6002022-06-13 HIGH 7.5 CVE-2022-29616 SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption. Netweaver As Abap Kernel Mitigation only Fix from $1,9502022-05-11 HIGH 8.8 CVE-2022-29611 SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in esc… Netweaver Application Server Abap Mitigation only Fix from $1,9502022-05-11 HIGH 7.8 CVE-2022-28214 During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed… Businessobjects Mitigation only Fix from $1,9502022-05-11 MEDIUM 6.1 CVE-2022-27656 The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, res… Netweaver As Abap Kernel Mitigation only Fix from $1,6002022-05-11 MEDIUM 5.5 CVE-2022-28774 Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted. Host Agent No fix yet Fix from $1,6002022-05-11 MEDIUM 5.4 CVE-2022-29610 SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Store… Netweaver Application Server Abap Mitigation only Fix from $1,6002022-05-11 HIGH 8.1 CVE-2022-28213EPSS 12% When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the … Businessobjects Business Intelligence Platform No fix yet Fix from $1,9502022-04-12 HIGH 7.5 CVE-2022-27667 Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to ac… Businessobjects Business Intelligence Platform Mitigation only Fix from $1,9502022-04-12 HIGH 7.5 CVE-2022-27669 An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access … Netweaver Application Server For Java Mitigation only Fix from $1,9502022-04-12 HIGH 7.5 CVE-2022-28772 By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86,… Netweaver Mitigation only Fix from $1,9502022-04-12 HIGH 7.5 CVE-2022-28773 Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of servic… Netweaver Mitigation only Fix from $1,9502022-04-12 MEDIUM 6.5 CVE-2022-27654 When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, t… 3d Visual Enterprise Viewer Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-27655 When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the … 3d Visual Enterprise Viewer Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-27670 SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashi… Sql Anywhere Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-27671 A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. Businessobjects Business Intelligence Platform Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.1 CVE-2022-28216 SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticate… Businessobjects Business Intelligence Platform Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.1 CVE-2022-28770 Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script in… Sapui5 Library Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-22541 SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through r… Businessobjects Business Intelligence Platform Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-26106 When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - v… 3d Visual Enterprise Viewer Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-26107 When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version … 3d Visual Enterprise Viewer Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-26108 When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the… 3d Visual Enterprise Viewer Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.5 CVE-2022-26109 When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - ver… 3d Visual Enterprise Viewer Mitigation only Fix from $1,6002022-04-12 MEDIUM 6.1 CVE-2022-26105 SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated … Netweaver Enterprise Portal Mitigation only Fix from $1,6002022-04-12 HIGH 7.5 CVE-2022-27658 Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information gathering… Innovation Management Mitigation only Fix from $1,9502022-03-28 MEDIUM 5.3 CVE-2022-26103 Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to … Netweaver Application Server Java Mitigation only Fix from $1,6002022-03-10 MEDIUM 5.3 CVE-2022-26104 SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthor… Financial Consolidation Mitigation only Fix from $1,6002022-03-10 MEDIUM 5.4 CVE-2022-26102 Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to acc… Netweaver Application Server Abap Mitigation only Fix from $1,6002022-03-10 CRITICAL 9.8 CVE-2022-26100 SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacke… Sapcar Mitigation only Fix from $2,3002022-03-10 MEDIUM 6.1 CVE-2022-26101 Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fiori Launchpad No fix yet Fix from $1,6002022-03-10