SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-37486Information Disclosure vulnerability in SAP Commerce (OCC API)
- CVE-2023-39440Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2023-39439SAP Commerce accepts empty passphrases.
- CVE-2023-39437Cross-Site Scripting (XSS) vulnerability in SAP Business One
- CVE-2023-39436Information Disclosure in SAP Supplier Relationship Management
- CVE-2023-37492Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2023-37491Improper Authorization check vulnerability in SAP Message Server
- CVE-2023-37490Binary hijack in SAP BusinessObjects Business Intelligence (Installer)
- CVE-2023-37488Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration
- CVE-2023-37487Security misconfiguration vulnerability in SAP Business One (Service Layer)
- CVE-2023-37484Information Disclosure Vulnerabilities in SAP PowerDesigner
- CVE-2023-37483Improper Access Control Vulnerabilities in SAP PowerDesigner
- CVE-2023-36926Information disclosure vulnerability in SAP Host Agent
- CVE-2023-36923Code Injection vulnerability in SAP PowerDesigner
- CVE-2023-33993SQL Injection vulnerability in SAP Business One B1i Layer
- CVE-2023-36925Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)
- CVE-2023-36924Log Injection vulnerability in SAP ERP Defense Forces and Public Security
- CVE-2023-36922OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
- CVE-2023-36921Header Injection in SAP Solution Manager (Diagnostic Agent)
- CVE-2023-36919Information Disclosure in SAP Enable Now
- CVE-2023-36918Cross-Site Scripting vulnerability in SAP Enable Now
- CVE-2023-36917Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform
- CVE-2023-35874Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2023-35873Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)
- CVE-2023-35872Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)
- CVE-2023-35871Memory Corruption vulnerability in SAP Web Dispatcher
- CVE-2023-35870Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)
- CVE-2023-33992Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA
- CVE-2023-33990Denial of Service (DoS) vulnerability in SAP SQL Anywhere
- CVE-2023-33989Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)