CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-11415 79 XSS 2018-05-24 2018-06-26
4.3
None Remote Medium Not required None Partial None
SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product.
2 CVE-2018-2479 79 XSS 2018-11-13 2018-11-23
4.3
None Remote Medium Not required None Partial None
SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
3 CVE-2018-2472 79 XSS 2018-10-09 2018-11-23
4.3
None Remote Medium Not required None Partial None
SAP BusinessObjects Business Intelligence Platform 4.10 and 4.20 (Web Intelligence DHTML client) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
4 CVE-2018-2470 79 XSS 2018-10-09 2018-11-26
4.3
None Remote Medium Not required None Partial None
In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
5 CVE-2018-2464 79 XSS 2018-09-11 2018-11-09
4.3
None Remote Medium Not required None Partial None
SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.
6 CVE-2018-2460 295 2018-09-11 2018-11-16
4.3
None Remote Medium Not required Partial None None
SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This allows attacker to do MITM attack.
7 CVE-2018-2457 200 +Info 2018-09-11 2018-11-16
4.0
None Remote Low Single system Partial None None
Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access information which would otherwise be restricted.
8 CVE-2018-2452 79 XSS 2018-09-11 2018-11-09
4.3
None Remote Medium Not required None Partial None
The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.
9 CVE-2018-2447 89 Sql 2018-08-14 2018-10-11
4.0
None Remote Low Single system Partial None None
SAP BusinessObjects Business Intelligence (Launchpad Web Intelligence), version 4.2, allows an attacker to execute crafted InfoObject queries, exposing the CMS InfoObjects database.
10 CVE-2018-2444 79 XSS 2018-08-14 2018-10-12
4.3
None Remote Medium Not required None Partial None
SAP BusinessObjects Financial Consolidation, versions 10.0, 10.1, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
11 CVE-2018-2439 20 2018-07-10 2018-09-12
4.3
None Remote Medium Not required None None Partial
The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for authenticity and validity) and under certain conditions, will process invalid requests. Several areas of the SAP Internet Graphics Server (IGS) did not require sufficient input validation. Namely, the SAP Internet Graphics Server (IGS) HTTP and RFC listener, SAP Internet Graphics Server (IGS) portwatcher when registering a portwatcher to the multiplexer and the SAP Internet Graphics Server (IGS) multiplexer had insufficient input validation and thus allowing a malformed data packet to cause a crash.
12 CVE-2018-2435 79 XSS 2018-07-10 2018-09-05
4.3
None Remote Medium Not required None Partial None
SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
13 CVE-2018-2434 20 2018-07-10 2018-09-11
4.3
None Remote Medium Not required None Partial None
A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.
14 CVE-2018-2432 113 XSS 2018-07-10 2018-09-06
4.9
None Remote Medium Single system Partial Partial None
SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.
15 CVE-2018-2431 79 XSS 2018-07-10 2018-09-06
4.3
None Remote Medium Not required None Partial None
SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
16 CVE-2018-2416 20 2018-05-09 2018-08-15
4.0
None Remote Low Single system None None Partial
SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source.
17 CVE-2018-2415 172 2018-05-09 2018-06-14
4.3
None Remote Medium Not required None Partial None
SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50) do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are displayed.
18 CVE-2018-2406 428 Dir. Trav. 2018-04-10 2018-05-22
4.6
None Local Low Not required Partial Partial Partial
Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path.
19 CVE-2018-2403 200 +Info 2018-04-10 2018-05-17
4.0
None Remote Low Single system Partial None None
Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an authorized user to get SAP Disclosure Management to point a specific chapter type to a chapter the user has not been given access to.
20 CVE-2018-2399 79 XSS 2018-03-14 2018-04-06
4.3
None Remote Medium Not required None Partial None
Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs.
21 CVE-2018-2396 264 2018-02-14 2018-02-27
4.0
None Remote Low Single system None None Partial
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, using IGS Interpreter service.
22 CVE-2018-2391 264 2018-02-14 2018-02-27
4.0
None Remote Low Single system None None Partial
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS portwatcher service.
23 CVE-2018-2390 264 2018-02-14 2018-02-27
4.0
None Remote Low Single system None None Partial
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service.
24 CVE-2018-2389 20 2018-02-14 2018-02-27
4.0
None Remote Low Single system None Partial None
Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important information in the log file.
25 CVE-2018-2388 79 XSS 2018-02-14 2018-02-27
4.3
None Remote Medium Not required None Partial None
Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.
26 CVE-2018-2387 200 +Info 2018-02-14 2018-02-27
4.0
None Remote Low Single system Partial None None
A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on ports, which is not available to the user otherwise.
27 CVE-2018-2386 119 Overflow 2018-02-14 2018-02-27
4.0
None Remote Low Single system None None Partial
Under certain conditions a malicious user provoking an out of bounds buffer overflow can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53.
28 CVE-2018-2385 369 2018-02-14 2018-02-27
4.0
None Remote Low Single system None None Partial
Under certain conditions a malicious user provoking a divide by zero crash can prevent legitimate users from accessing the SAP Internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, and its services.
29 CVE-2018-2384 476 2018-02-14 2018-02-27
4.0
None Remote Low Single system None None Partial
Under certain conditions a malicious user provoking a Null Pointer dereference can prevent legitimate users from accessing the SAP Internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, and its services.
30 CVE-2018-2383 79 XSS 2018-02-14 2018-02-27
4.3
None Remote Medium Not required None Partial None
Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53.
31 CVE-2018-2382 200 +Info 2018-02-14 2018-02-27
4.0
None Remote Low Single system Partial None None
A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a controlled area and as such gain information from system area, which is not available to the user otherwise.
32 CVE-2018-2379 284 2018-02-14 2018-03-01
4.0
None Remote Low Single system Partial None None
In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint.
33 CVE-2018-2378 284 2018-02-14 2018-03-01
4.0
None Remote Low Single system Partial None None
In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption.
34 CVE-2018-2377 284 2018-02-14 2018-03-01
4.0
None Remote Low Single system Partial None None
In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users.
35 CVE-2018-2374 284 2018-02-14 2018-03-01
4.0
None Remote Low Single system Partial None None
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space.
36 CVE-2018-2372 200 +Info 2018-02-14 2018-03-15
4.0
None Remote Low Single system Partial None None
A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communication.
37 CVE-2018-2371 79 XSS 2018-02-14 2018-03-15
4.3
None Remote Medium Not required None Partial None
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability.
38 CVE-2018-2365 79 XSS 2018-03-01 2018-03-23
4.3
None Remote Medium Not required None Partial None
SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
39 CVE-2018-2364 79 XSS 2018-02-14 2018-03-07
4.3
None Remote Medium Not required None Partial None
SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.
40 CVE-2017-16685 79 XSS 2017-12-12 2017-12-21
4.3
None Remote Medium Not required None Partial None
Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding of user controlled inputs.
41 CVE-2017-16683 DoS 2017-12-12 2017-12-21
4.0
None Remote Low Single system None None Partial
Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a service.
42 CVE-2017-16681 79 XSS 2017-12-12 2017-12-21
4.3
None Remote Medium Not required None Partial None
Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user controlled inputs are not sufficiently encoded.
43 CVE-2017-15294 79 XSS 2017-10-16 2018-12-10
4.3
None Remote Medium Not required None Partial None
The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.
44 CVE-2017-14516 79 XSS 2017-12-03 2017-12-19
4.3
None Remote Medium Not required None Partial None
Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292.
45 CVE-2017-11460 79 XSS 2017-07-25 2018-12-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp, aka SAP Security Note 2308535.
46 CVE-2017-11457 611 2017-07-25 2018-12-10
4.0
None Remote Low Single system Partial None None
XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249.
47 CVE-2017-10701 79 XSS 2017-09-28 2017-10-06
4.3
None Remote Medium Not required None Partial None
Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516.
48 CVE-2017-9843 264 DoS 2017-07-12 2018-12-10
4.0
None Remote Low Single system None None Partial
SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841.
49 CVE-2017-6061 79 XSS 2017-03-16 2017-03-16
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arbitrary web script or HTML via a GET request. /finance/help/en/frameset.htm is the URI for this component. The vendor response is SAP Security Note 2368106.
50 CVE-2016-10310 119 DoS Overflow 2017-04-10 2018-12-10
4.0
None Remote Low Single system None None Partial
Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated users to cause a denial of service (resource consumption and process crash) by sending a crafted packet several times, aka SAP Security Note 2308778.
Total number of vulnerabilities : 109   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.