Sap Security Vulnerabilities (CVEs)

This vulnerability allows authenticated users with restricted access in SAP BusinessObjects Business Intelligence Platform to inject malicious JavaScr...

SAP BusinessObjects Business Intelligence Platform has an information disclosure vulnerability that allows unauthenticated attackers to hijack user se...

SAP NetWeaver AS ABAP and ABAP Platform have an authorization bypass vulnerability in RFC function modules. Attackers with basic user privileges can e...

SAP NetWeaver Application Server for ABAP and ABAP Platform contains an information disclosure vulnerability where unauthenticated attackers can acces...

CVE-2024-32732 is an information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform that allows attackers to access restri...

This CVE describes a cross-site scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal's KMC servlet where user inputs aren't properly encod...

The SAP HANA Node.js client package versions 2.0.0 through 2.21.30 are vulnerable to prototype pollution when using the nestTables feature. This allow...

This vulnerability allows attackers to modify read-only fields in Bank Statement Drafts within SAP's Manage Bank Statements application using the ODat...

CVE-2024-37179 is an unrestricted file download vulnerability in SAP BusinessObjects Business Intelligence Platform. Authenticated attackers can explo...

This vulnerability in SAP for Oil & Gas (Transportation and Distribution) allows authenticated non-administrative users to delete non-sensitive entrie...

CVE-2024-39591 is an authorization bypass vulnerability in SAP Document Builder where a specific function module lacks proper authorization checks. Th...

This vulnerability in SAP Student Life Cycle Management (SLcM) allows authenticated users to bypass authorization checks and delete non-sensitive repo...

CVE-2024-41737 is a server-side request forgery (SSRF) vulnerability in SAP CRM ABAP Insights Management that allows authenticated attackers to enumer...

This XML injection vulnerability in SAP BEx Web Java Runtime Export Web Service allows attackers to retrieve sensitive information from SAP ADS system...

CVE-2024-42376 is an authorization bypass vulnerability in SAP Shared Service Framework where authenticated users can escalate privileges without prop...

SAP Commerce Backoffice has a cross-site scripting (XSS) vulnerability where insufficient input encoding allows attackers to inject malicious scripts....

This vulnerability in SAP NetWeaver Application Server ABAP allows unauthenticated attackers to craft URLs that bypass allowlist controls. Attackers c...

This vulnerability in SAP Commerce Cloud's OCC API endpoints allows attackers to access sensitive PII data like passwords, email addresses, and coupon...

CVE-2024-39600 is a memory disclosure vulnerability in SAP GUI for Windows where passwords remain in memory after login, potentially allowing attacker...

SAP Business Warehouse - Business Planning and Simulation application has a reflected cross-site scripting (XSS) vulnerability due to insufficient inp...

This Server-Side Request Forgery (SSRF) vulnerability in SAP Transportation Management (Collaboration Portal) allows authenticated non-administrative ...

CVE-2024-37175 is a missing authorization vulnerability in SAP CRM WebClient that allows authenticated users to escalate privileges and access sensiti...

This CVE describes a cross-site scripting (XSS) vulnerability in SAP CRM WebClient UI's custom CSS support option. Attackers can inject malicious scri...

CVE-2024-39592 is an authorization bypass vulnerability in SAP PDCE (Product Data Cloud Edition) that allows authenticated users to escalate privilege...

This CVE describes a cross-site scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor where weak encoding of user-controlled i...

This is a cross-site scripting (XSS) vulnerability in SAP CRM WebClient UI that allows unauthenticated attackers to craft malicious URLs containing sc...

This vulnerability in SAP NetWeaver AS Java allows attackers to perform denial-of-service attacks by exploiting unrestricted access to Meta Model Repo...

CVE-2024-34691 is an authorization bypass vulnerability in SAP S/4HANA's Manage Incoming Payment Files (F1680) transaction. Authenticated users can pe...

An authenticated attacker can upload malicious files to the SAP Document Builder service, which when accessed by a victim allows the attacker to acces...

SAP Business Objects Business Intelligence Platform contains a stored cross-site scripting (XSS) vulnerability in the Opendocument URL parameter. Atta...

CVE-2024-25646 is an information disclosure vulnerability in SAP BusinessObjects Business Intelligence Launch Pad where improper validation allows aut...

CVE-2024-24743 is an XML external entity (XXE) vulnerability in SAP NetWeaver AS Java's Guided Procedures component. Unauthenticated attackers can sub...

This CVE describes a cross-site scripting (XSS) vulnerability in SAP CRM WebClient UI's print preview feature. Attackers with low-privilege access can...

SAP LT Replication Server in specified S4CORE versions lacks proper authorization checks, allowing authenticated high-privilege users to escalate priv...

This vulnerability in the Emarsys SDK for Android allows attackers to bypass authorization checks and launch arbitrary web pages or deep links from th...

This vulnerability in SAP GUI for Windows and Java allows unauthenticated attackers to access restricted information and create ABAP List Viewer layou...

This vulnerability allows locked B2B users in SAP Commerce Cloud to bypass account restrictions by exploiting the forgotten password functionality whe...

SAP Business Objects Business Intelligence Platform contains a stored cross-site scripting (XSS) vulnerability that allows authenticated attackers to ...

This vulnerability allows authenticated attackers to bypass file type validation in SAP BusinessObjects Business Intelligence Platform's Web Intellige...

CVE-2023-39438 is an authorization bypass vulnerability in CLA-assistant that allows any authenticated user to read, update, or delete CLA (Contributo...

CVE-2023-39437 is a cross-site scripting (XSS) vulnerability in SAP Business One version 10.0 that allows attackers to inject malicious scripts into w...