CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-8669 94 Exec Code 2014-11-06 2014-11-06
10.0
None Remote Low Not required Complete Complete Complete
The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.
2 CVE-2014-8668 89 Exec Code Sql 2014-11-06 2014-11-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
3 CVE-2014-8667 79 XSS 2014-11-06 2014-11-06
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
4 CVE-2014-8666 200 +Info 2014-11-06 2014-11-06
5.0
None Remote Low Not required Partial None None
The User & Server configuration, InfoView refresh, user rights (BI-BIP-ADM) component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors.
5 CVE-2014-8665 200 +Info 2014-11-06 2014-11-06
5.0
None Remote Low Not required Partial None None
The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files.
6 CVE-2014-8664 89 Exec Code Sql 2014-11-06 2014-11-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
7 CVE-2014-8663 89 Exec Code Sql 2014-11-06 2014-11-06
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
8 CVE-2014-8662 DoS 2014-11-06 2014-11-06
7.8
None Remote Low Not required None None Complete
Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling.
9 CVE-2014-8661 94 Exec Code 2014-11-06 2014-11-06
10.0
None Remote Low Not required Complete Complete Complete
The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors.
10 CVE-2014-8660 94 Exec Code 2014-11-06 2014-11-06
7.2
None Local Low Not required Complete Complete Complete
SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors.
11 CVE-2014-8659 22 Dir. Trav. 2014-11-06 2014-11-06
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in SAP Environment, Health, and Safety allows remote attackers to read arbitrary files via unspecified vectors.
12 CVE-2014-8592 DoS 2014-11-04 2014-11-13
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via a crafted request.
13 CVE-2014-8591 DoS 2014-11-04 2014-11-20
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via unknown vectors.
14 CVE-2014-8590 2014-11-04 2014-11-20
4.3
None Remote Medium Not required Partial None None
XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted request.
15 CVE-2014-8589 189 DoS Overflow 2014-11-04 2014-11-13
5.0
None Remote Low Not required None None Partial
Integer overflow in SAP Network Interface Router (SAProuter) 40.4 allows remote attackers to cause a denial of service (resource consumption) via crafted requests.
16 CVE-2014-8588 89 Exec Code Sql 2014-11-04 2014-11-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
17 CVE-2014-8587 310 2014-11-04 2014-11-05
7.5
None Remote Low Not required Partial Partial Partial
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors.
18 CVE-2014-8316 20 2014-10-16 2014-10-28
5.0
None Remote Low Not required Partial None None
XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request.
19 CVE-2014-8315 200 +Info 2014-10-16 2014-10-21
5.0
None Remote Low Not required Partial None None
polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter.
20 CVE-2014-8314 79 XSS 2014-10-16 2014-10-23
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) epm/admin/DataGen.xsjs or (2) epm/services/multiply.xsjs in the democontent.
21 CVE-2014-8313 94 Exec Code 2014-10-16 2014-10-23
6.0
None Remote Medium Single system Partial Partial Partial
Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified vectors.
22 CVE-2014-8312 +Info 2014-10-16 2014-11-05
3.5
None Remote Medium Single system Partial None None
Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function.
23 CVE-2014-8311 +Info 2014-10-16 2014-10-21
3.5
None Remote Medium Single system Partial None None
SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener.
24 CVE-2014-8310 20 DoS 2014-10-16 2014-10-23
7.1
None Remote Medium Not required None None Complete
The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
25 CVE-2014-8309 200 +Info 2014-10-16 2014-10-23
5.0
None Remote Low Not required Partial None None
SAP BusinessObjects 4.0 and BusinessObjects XI (BOXI) R2 and 3.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames via SecEnterprise authentication requests to the Session web service.
26 CVE-2014-8308 79 XSS 2014-10-16 2014-10-23
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Send to Inbox functionality in SAP BusinessObjects BI EDGE 4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
27 CVE-2014-6283 264 Overflow 2014-10-17 2014-10-24
6.5
None Remote Low Single system Partial Partial Partial
SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a crafted RPC message to the hacmpmsgxchg function, and possibly other vectors.
28 CVE-2014-6252 119 DoS Exec Code Overflow 2014-09-05 2014-09-08
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors.
29 CVE-2014-5506 Exec Code 2014-09-04 2014-09-13
6.8
None Remote Medium Not required Partial Partial Partial
Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
30 CVE-2014-5505 119 Exec Code Overflow 2014-09-04 2014-09-13
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
31 CVE-2014-5176 2014-07-31 2014-09-04
6.0
None Remote Medium Single system Partial Partial Partial
SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.
32 CVE-2014-5175 287 Bypass 2014-07-31 2014-08-27
7.5
None Remote Low Not required Partial Partial Partial
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
33 CVE-2014-5174 264 +Info 2014-07-31 2014-09-04
3.5
None Remote Medium Single system Partial None None
The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
34 CVE-2014-5173 264 Bypass 2014-07-31 2014-08-01
5.0
None Remote Low Not required Partial None None
SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.
35 CVE-2014-5172 79 XSS 2014-07-31 2014-09-04
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
36 CVE-2014-5171 310 +Info 2014-07-31 2014-08-01
2.9
None Local Network Medium Not required Partial None None
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.
37 CVE-2014-4161 79 XSS 2014-06-13 2014-06-16
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
38 CVE-2014-4160 79 XSS 2014-06-13 2014-06-21
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) sap-accessibility parameter.
39 CVE-2014-4159 2014-06-13 2014-06-26
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
40 CVE-2014-4012 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
41 CVE-2014-4011 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
42 CVE-2014-4010 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
43 CVE-2014-4009 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
44 CVE-2014-4008 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
45 CVE-2014-4007 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
46 CVE-2014-4006 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
47 CVE-2014-4005 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
48 CVE-2014-4004 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
49 CVE-2014-4003 264 2014-06-09 2014-07-08
7.5
None Remote Low Not required Partial Partial Partial
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
50 CVE-2014-3787 200 +Info 2014-05-19 2014-05-20
5.0
None Remote Low Not required Partial None None
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors.
Total number of vulnerabilities : 216   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.