SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-49058Directory Traversal vulnerability in SAP Master Data Governance
- CVE-2023-42481Improper Access Control vulnerability in SAP Commerce Cloud
- CVE-2023-42479Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct
- CVE-2023-42478Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2023-42476Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
- CVE-2023-42480Information Disclosure in NetWeaver AS Java Logon
- CVE-2023-41366Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2023-31403Improper Access Control vulnerability in SAP Business One product installation
- CVE-2023-36920Clickjacking vulnerability in SAP Enable Now
- CVE-2023-42477Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)
- CVE-2023-42475Information Disclosure Vulnerability in Statutory Reporting
- CVE-2023-42474Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence
- CVE-2023-42473Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)
- CVE-2023-41365Information Disclosure vulnerability in SAP Business One (B1i)
- CVE-2023-40310Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import
- CVE-2023-40307Privileges Memory Corruption (Out-of-bound write)
- CVE-2023-40309Missing Authorization check in SAP CommonCryptoLib
- CVE-2023-40621Code Injection vulnerability in SAP PowerDesigner Client
- CVE-2023-40622Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
- CVE-2023-40623Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)
- CVE-2023-40624Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)
- CVE-2023-40625Missing Authorization check in SAP Manage Purchase Contracts App
- CVE-2023-41367Missing Authentication check in SAP NetWeaver (Guided Procedures)
- CVE-2023-41368Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)
- CVE-2023-41369External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
- CVE-2023-42472Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
- CVE-2023-40308Memory Corruption vulnerability in SAP CommonCryptoLib
- CVE-2023-37489Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)
- CVE-2023-40306URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
- CVE-2023-39438Missing Authorization check allows certain operations on CLA Assistant data