SAP CVEs
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-0256Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise
- CVE-2019-0254SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scri
- CVE-2019-0251The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in C
- CVE-2019-0249Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.
- CVE-2019-0248Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker
- CVE-2019-0247SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application.
- CVE-2019-0246SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.
- CVE-2019-0245SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contr
- CVE-2019-0244SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contr
- CVE-2019-0243Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorizat
- CVE-2019-0241SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, eith
- CVE-2019-0240SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI lin
- CVE-2019-0238SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting i
- CVE-2018-2499A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover
- CVE-2018-2484SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04,
- CVE-2018-2505SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts tha
- CVE-2018-2504SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Ma
- CVE-2018-2503By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected.
- CVE-2018-2502TRACE method is enabled in SAP Business One Service Layer .
- CVE-2018-2500Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to access information w
- CVE-2018-2497The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax
- CVE-2018-2494Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP
- CVE-2018-2492SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source.
- CVE-2018-2486SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-Sit
- CVE-2018-2491When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file.
- CVE-2018-2490The broadcast messages received by SAP Fiori Client are not protected by permissions.
- CVE-2018-2489Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client.
- CVE-2018-2488It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori
- CVE-2018-2487SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in speci
- CVE-2018-2485It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application.