NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP producten
view advisory published 2024-08-13
SAP heeft kwetsbaarheden verholpen in diverse producten als SAP Business Objects, SAP HANA, Netweaver en Document Builder.
01
describes (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-42373US | medium5.4OT elevated | — | ||
SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful expl… | ||||
| CVE-2024-41734US | medium4.3OT elevated | — | ||
Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclo… | ||||
| CVE-2024-39591US | medium5.3OT elevated | — | ||
SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of… | ||||
| CVE-2024-42376US | medium6.5OT elevated | — | ||
SAP Shared Service Framework does not perform necessary
authorization check for an authenticated user, resulting in escalation of
privileges. On successful exploitation, an attacke… | ||||
| CVE-2024-42375US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On suc… | ||||
| CVE-2024-42374US | high8.2 | — | ||
BEx Web Java Runtime Export Web Service does not
sufficiently validate an XML document accepted from an untrusted source. An
attacker can retrieve information from the SAP ADS syst… | ||||
| CVE-2024-41737US | medium5.0 | — | ||
SAP CRM ABAP (Insights
Management) allows an authenticated attacker to enumerate HTTP endpoints in the
internal network by specially crafting HTTP requests. On successful
exploitat… | ||||
| CVE-2024-41736US | medium4.3 | — | ||
Under certain conditions SAP Permit to Work
allows an authenticated attacker to access information which would otherwise be
restricted causing low impact on the confidentiality of… | ||||
| CVE-2024-41735US | medium5.4 | — | ||
SAP Commerce Backoffice does not sufficiently
encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)
vulnerability causing low impact on confidentiality and integri… | ||||
| CVE-2024-41733US | medium5.3 | — | ||
In SAP Commerce, valid user accounts can be
identified during the customer registration and login processes. This allows a
potential attacker to learn if a given e-mail is used for… | ||||
| CVE-2024-41732US | medium5.4 | — | ||
SAP NetWeaver Application Server ABAP allows
an unauthenticated attacker to craft a URL link that could bypass allowlist
controls. Depending on the web applications provided by… | ||||
| CVE-2024-41731US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On success… | ||||
| CVE-2024-41730US | critical9.8OT high | — | ||
In SAP BusinessObjects Business Intelligence
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint… | ||||
| CVE-2024-33005US | medium6.3OT elevated | — | ||
Due to the missing authorization checks in the
local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application
Server (ABAP and Java), and SAP Content Server can im… | ||||
| CVE-2024-33003US | critical9.1 | — | ||
Some OCC API endpoints in SAP Commerce Cloud
allows Personally Identifiable Information (PII) data, such as passwords, email
addresses, mobile numbers, coupon codes, and voucher co… | ||||
| CVE-2024-28166US | medium4.3 | — | ||
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On suc… | ||||
| CVE-2024-29415US | — | Exploit | ||
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly cat… | ||||
| CVE-2023-30533US | high7.8 | Exploit | ||
SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected. | ||||
| CVE-2023-0286US | high7.4 | — | ||
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure def… | ||||
| CVE-2023-0215US | high7.5 | — | ||
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 st… | ||||
showing 20 of 21
02
references
External citations — patches, advisories, analysis.
- Reference - certbunddeexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan