NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP producten
view advisory published 2024-05-17
SAP heeft kwetsbaarheden verholpen in diverse producten, zoals NetWeaver, Business Objects, HANA en SAP GUI.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-4139US | —OT elevated | — | ||
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulner… | ||||
| CVE-2024-4138US | —OT elevated | — | ||
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulner… | ||||
| CVE-2024-34687US | critical9.0 | — | ||
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
An attacker ca… | ||||
| CVE-2024-33009US | — | — | ||
SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of… | ||||
| CVE-2024-33008US | — | — | ||
SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with hig… | ||||
| CVE-2024-33007US | — | — | ||
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmfu… | ||||
| CVE-2024-33006US | — | — | ||
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
| ||||
| CVE-2024-33004US | — | — | ||
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, th… | ||||
| CVE-2024-33002US | — | — | ||
Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low… | ||||
| CVE-2024-33000US | —OT elevated | — | ||
SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confid… | ||||
| CVE-2024-32733US | — | — | ||
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicio… | ||||
| CVE-2024-32731US | —OT elevated | — | ||
SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker c… | ||||
| CVE-2024-28165US | critical9.3 | — | ||
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high imp… | ||||
| CVE-2024-32730US | —OT elevated | — | ||
SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker wi… | ||||
| CVE-2022-36364US | high8.8 | — | ||
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the… | ||||
02
references
External citations — patches, advisories, analysis.
- Reference - nvdexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan