NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden verholpen in diverse SAP-producten
SAP heeft kwetsbaarheden verholpen in SAP S/4HANA, SAP Commerce Cloud, SAP Forecasting & Replenishment, SAP NetWeaver Application Server voor ABAP, SAP Business Server Pages, SAP BusinessObjects Business Intelligence Platform, SAP Strategic Enterprise Management Scorecard Wizard, SAPUI5 Search UI, SAP Financial Consolidation, SAP Incentive and Commission Management, SAP Application Server ABAP voor SAP NetWeaver en ABAP Platform, en SAP HANA Deployment Infrastructure.
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-40137US | — | — | ||
SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled s… | ||||
| CVE-2026-40136US | — | — | ||
SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself… | ||||
| CVE-2026-40135US | — | — | ||
An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to… | ||||
| CVE-2026-40134US | —OT erhöht | — | ||
Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform ta… | ||||
| CVE-2026-40133US | —OT erhöht | — | ||
Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, result… | ||||
| CVE-2026-40132US | —OT erhöht | — | ||
Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they… | ||||
| CVE-2026-40131US | — | — | ||
SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements… | ||||
| CVE-2026-40129US | — | — | ||
Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the appli… | ||||
| CVE-2026-34263US | — | — | ||
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execu… | ||||
| CVE-2026-34260US | — | — | ||
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled… | ||||
| CVE-2026-34259US | — | — | ||
Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled funct… | ||||
| CVE-2026-34258US | — | — | ||
SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victi… | ||||
| CVE-2026-27682US | medium6.1 | — | ||
Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated attacker coul… | ||||
| CVE-2026-0502US | — | — | ||
Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send unintended requests to the… | ||||
| CVE-2025-68161US | medium4.8 | — | ||
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https:/… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Referenceexternal
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan