SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-22129Cross-Site Scripting (XSS) vulnerability in SAP Companion
- CVE-2024-25643Missing authorization check in SAP Fiori app (My Overtime Requests)
- CVE-2024-25642Improper Certificate Validation in SAP Cloud Connector
- CVE-2024-24743XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
- CVE-2024-24742Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
- CVE-2024-24740Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel)
- CVE-2024-24739Missing authorization check in SAP BAM (Bank Account Management)
- CVE-2024-22132Code Injection vulnerability in SAP IDES Systems
- CVE-2024-22131Code Injection vulnerability in SAP ABA (Application Basis)
- CVE-2024-22130Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
- CVE-2024-22128Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML
- CVE-2024-22126Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application)
- CVE-2024-22125Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge)
- CVE-2024-22124Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager
- CVE-2024-21738Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform
- CVE-2024-21737Code Injection vulnerability in SAP Application Interface Framework (File Adapter)
- CVE-2024-21736Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)
- CVE-2024-21735Improper Authorization check in SAP LT Replication Server
- CVE-2024-21734URL Redirection vulnerability in SAP Marketing (Contacts App)
- CVE-2023-50424Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)
- CVE-2023-50423Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)
- CVE-2023-6542Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID
- CVE-2023-49587Command Injection vulnerability in SAP Solution Manager
- CVE-2023-49584Client-Side Desynchronization vulnerability in SAP Fiori Launchpad
- CVE-2023-50422Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)
- CVE-2023-49583Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)
- CVE-2023-49581SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2023-49580Information disclosure in SAP GUI for Windows and SAP GUI for Java
- CVE-2023-49578Denial of service (DOS) in SAP Cloud Connector
- CVE-2023-49577Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)