CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-2752 255 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
2 CVE-2014-2751 255 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
3 CVE-2014-2749 200 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request.
4 CVE-2014-2748 264 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these details are obtained from third party information.
5 CVE-2014-1965 79 XSS 2014-02-14 2014-02-21
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP.
6 CVE-2014-1964 79 XSS 2014-02-14 2014-02-21
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.
7 CVE-2014-1963 DoS 2014-02-14 2014-02-21
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors.
8 CVE-2014-1962 200 +Info 2014-02-14 2014-02-21
5.0
None Remote Low Not required Partial None None
Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.
9 CVE-2014-1961 +Info 2014-02-14 2014-02-21
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors.
10 CVE-2014-1960 264 +Info 2014-02-14 2014-02-21
5.0
None Remote Low Not required Partial None None
The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors.
11 CVE-2014-0984 264 2014-04-17 2014-04-18
4.3
None Remote Medium Not required Partial None None
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtrain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
12 CVE-2013-7367 264 +Priv 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privileges via unspecified vectors.
13 CVE-2013-7366 287 DoS 2014-04-10 2014-04-11
5.0
None Remote Low Not required None None Partial
The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications.
14 CVE-2013-7365 79 XSS 2014-04-10 2014-04-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
15 CVE-2013-7364 264 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors.
16 CVE-2013-7363 +Info 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the configuration of applications, and install or remove applications via vectors involving the P4 protocol.
17 CVE-2013-7362 94 Exec Code 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.
18 CVE-2013-7361 22 Dir. Trav. 2014-04-10 2014-04-11
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors.
19 CVE-2013-7360 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors.
20 CVE-2013-7359 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in SAP Mobile Infrastructure allows remote attackers to obtain sensitive port information via unknown vectors, related to an "internal port scanning" issue.
21 CVE-2013-7358 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibly other identity information via unknown vectors.
22 CVE-2013-7357 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unknown vectors.
23 CVE-2013-7356 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors.
24 CVE-2013-7355 89 Exec Code Sql 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema.
25 CVE-2013-7096 89 Exec Code Sql 2013-12-13 2013-12-19
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
26 CVE-2013-7095 2013-12-13 2013-12-19
10.0
None Remote Low Not required Complete Complete Complete
The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.
27 CVE-2013-7094 89 Exec Code Sql 2013-12-13 2013-12-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
28 CVE-2013-7093 287 Bypass 2013-12-13 2013-12-16
5.0
None Remote Low Not required None Partial None
SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors.
29 CVE-2013-6869 89 Exec Code Sql 2013-11-23 2013-12-08
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
30 CVE-2013-6823 264 Bypass 2013-11-20 2013-11-20
6.4
None Remote Low Not required Partial Partial None
GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors.
31 CVE-2013-6822 2013-11-20 2013-11-20
10.0
None Remote Low Not required Complete Complete Complete
GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue.
32 CVE-2013-6821 22 Dir. Trav. 2013-11-20 2013-11-20
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors.
33 CVE-2013-6820 Exec Code 2013-11-20 2013-11-20
9.3
None Remote Medium Not required Complete Complete Complete
Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.
34 CVE-2013-6819 79 XSS 2013-11-20 2013-11-20
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
35 CVE-2013-6818 264 Bypass 2013-11-20 2013-11-20
6.4
None Remote Low Not required Partial Partial None
SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vectors.
36 CVE-2013-6817 119 DoS Exec Code Overflow 2013-11-20 2013-11-20
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages.
37 CVE-2013-6816 79 XSS 2013-11-20 2013-11-20
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
38 CVE-2013-6815 20 DoS 2013-11-20 2013-11-21
5.0
None Remote Low Not required None None Partial
The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue.
39 CVE-2013-6814 20 +Info 2013-11-20 2013-11-20
5.8
None Remote Medium Not required Partial Partial None
The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.
40 CVE-2013-6284 Exec Code 2013-10-26 2013-10-28
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Component (ECC) allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."
41 CVE-2013-6244 2013-10-23 2013-10-30
5.0
None Remote Low Not required Partial None None
The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
42 CVE-2013-5751 22 Dir. Trav. 2013-09-16 2013-10-02
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors.
43 CVE-2013-5723 89 Exec Code Sql 2013-09-12 2013-10-07
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0_DELETE_DERIVATION_TABLE."
44 CVE-2013-3319 200 +Info 2013-08-16 2013-10-07
5.0
None Remote Low Not required Partial None None
The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.
45 CVE-2013-3244 94 Exec Code 2013-10-23 2013-10-25
6.0
None Remote Medium Single system Partial Partial Partial
Multiple unspecified vulnerabilities in the CJDB_FILL_MEMORY_FROM_PPB function in the Project System (PS-IS) module for SAP ERP Central Component (ECC) allow remote attackers to execute arbitrary code via a (1) RFC or (2) SOAP-RFC request.
46 CVE-2013-3063 Exec Code 2013-05-01 2013-11-18
6.0
None Remote Medium Single system Partial Partial Partial
SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
47 CVE-2013-3062 264 Bypass 2013-05-01 2014-03-07
6.5
None Remote Low Single system Partial Partial Partial
The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.
48 CVE-2013-3061 264 Bypass 2013-05-01 2013-11-18
6.5
None Remote Low Single system Partial Partial Partial
The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.
49 CVE-2012-4341 119 DoS Exec Code Overflow 2012-08-15 2012-08-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value, (2) crafted string size field, or (3) long Parameter Name string in a package with opcode 0x43 and sub opcode 0x4 to TCP port 3900.
50 CVE-2012-2612 119 DoS Overflow 2012-05-15 2012-08-18
5.0
None Remote Low Not required None None Partial
The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
Total number of vulnerabilities : 158   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.