SAP CVEs
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-33674Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs.
- CVE-2021-38177SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends c
- CVE-2021-33685SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are out
- CVE-2021-33672Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in cha
- CVE-2021-38175SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather
- CVE-2021-38163SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administra
- CVE-2021-37535SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary auth
- CVE-2021-33675Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs.
- CVE-2021-33679The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script
- CVE-2021-38176Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in
- CVE-2021-38164SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730,
- CVE-2021-33673Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them.
- CVE-2021-38162SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7
- CVE-2021-37532SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conte
- CVE-2021-21489SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulti
- CVE-2021-37531SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a no
- CVE-2021-38150When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP
- CVE-2021-33708Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges.
- CVE-2021-33706Due to improper input validation in InfraBox, logs can be modified by an authenticated user.
- CVE-2021-33702Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode rep
- CVE-2021-33703Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters.
- CVE-2021-33707SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL st
- CVE-2021-33699Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifes
- CVE-2021-33682SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- CVE-2021-33687SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP
- CVE-2021-33683SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22
- CVE-2021-33689When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version
- CVE-2021-33684SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC
- CVE-2021-33678A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A
- CVE-2021-33670SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send