DeutschShown in its original language — a full translation is planned for a future version.
SAP Software: Mehrere Schwachstellen
view advisory published 2024-05-13
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder um vertrauliche Informationen offenzulegen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-4139US | —OT elevated | — | ||
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulner… | ||||
| CVE-2024-4138US | —OT elevated | — | ||
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulner… | ||||
| CVE-2024-34687US | critical9.0 | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
An attacker ca… | ||||
| CVE-2024-33009US | — | — | ||
SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of… | ||||
| CVE-2024-33008US | — | — | ||
SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with hig… | ||||
| CVE-2024-33007US | — | — | ||
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmfu… | ||||
| CVE-2024-33006US | — | — | ||
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
| ||||
| CVE-2024-33004US | — | — | ||
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, th… | ||||
| CVE-2024-33002US | — | — | ||
Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low… | ||||
| CVE-2024-33000US | —OT elevated | — | ||
SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confid… | ||||
| CVE-2024-32733US | — | — | ||
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicio… | ||||
| CVE-2024-32731US | —OT elevated | — | ||
SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker c… | ||||
| CVE-2024-28165US | critical9.3 | — | ||
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high imp… | ||||
| CVE-2024-32730US | —OT elevated | — | ||
SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker wi… | ||||
| CVE-2022-36364US | high8.8 | — | ||
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the… | ||||
| CVE-2019-17495US | critical9.8 | Exploit | ||
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input f… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan