NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden verholpen in SAP producten
Advisory ansehen veröffentlicht 2026-01-13
SAP heeft kwetsbaarheden verholpen in SAP S/4HANA (Private Cloud en On-Premise), SAP Wily Introscope Enterprise Manager, SAP Landscape Transformation, SAP HANA, SAP Application Server voor ABAP, SAP NetWeaver, SAP ECC, SAP Fiori App voor Intercompany Balance Reconciliation, SAP NetWeaver Application Server ABAP, SAP Business Connector, SAP Supplier Relationship Management, SAP Identity Management, en SAP User Management Engine.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-0514US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, t… | ||||
| CVE-2026-0513US | medium4.7 | — | ||
Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if access… | ||||
| CVE-2026-0511US | —OT erhöht | — | ||
SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high im… | ||||
| CVE-2026-0510US | — | — | ||
The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness… | ||||
| CVE-2026-0507US | — | — | ||
Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network… | ||||
| CVE-2026-0506US | —OT erhöht | — | ||
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FO… | ||||
| CVE-2026-0504US | — | — | ||
Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are pr… | ||||
| CVE-2026-0503US | —OT erhöht | — | ||
Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and b… | ||||
| CVE-2026-0501US | — | — | ||
Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modif… | ||||
| CVE-2026-0500US | high8.8 | — | ||
Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Networ… | ||||
| CVE-2026-0499US | — | — | ||
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed i… | ||||
| CVE-2026-0498US | high7.2 | — | ||
SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injecti… | ||||
| CVE-2026-0497US | —OT erhöht | — | ||
SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidential… | ||||
| CVE-2026-0494US | — | — | ||
Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low im… | ||||
| CVE-2026-0493US | — | — | ||
Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions using an inappropriat… | ||||
| CVE-2026-0492US | —OT erhöht | — | ||
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access.… | ||||
| CVE-2026-0491US | — | — | ||
SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrar… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Referenceexternal
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan