CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-4161 79 XSS 2014-06-13 2014-06-16
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
2 CVE-2014-4160 79 XSS 2014-06-13 2014-06-21
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) sap-accessibility parameter.
3 CVE-2014-4159 2014-06-13 2014-06-26
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
4 CVE-2014-4012 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
5 CVE-2014-4011 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
6 CVE-2014-4010 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
7 CVE-2014-4009 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
8 CVE-2014-4008 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
9 CVE-2014-4007 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
10 CVE-2014-4006 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
11 CVE-2014-4005 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
12 CVE-2014-4004 255 2014-06-09 2014-06-18
5.0
None Remote Low Not required Partial None None
The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
13 CVE-2014-4003 264 2014-06-09 2014-07-08
7.5
None Remote Low Not required Partial Partial Partial
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
14 CVE-2014-3787 200 +Info 2014-05-19 2014-05-20
5.0
None Remote Low Not required Partial None None
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors.
15 CVE-2014-3134 79 XSS 2014-04-30 2014-05-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
16 CVE-2014-3133 264 2014-04-30 2014-05-10
5.0
None Remote Low Not required Partial None None
SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection.
17 CVE-2014-3132 264 +Info 2014-04-30 2014-05-10
4.0
None Remote Low Single system Partial None None
SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
18 CVE-2014-3131 264 +Info 2014-04-30 2014-05-10
4.0
None Remote Low Single system Partial None None
SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
19 CVE-2014-3130 264 +Priv 2014-04-30 2014-05-10
4.6
User Local Low Not required Partial Partial Partial
The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages.
20 CVE-2014-3129 200 +Info 2014-04-30 2014-05-10
5.0
None Remote Low Not required Partial None None
The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1.
21 CVE-2014-2752 255 2014-04-10 2014-06-18
7.5
None Remote Low Not required Partial Partial Partial
SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
22 CVE-2014-2751 255 2014-04-10 2014-06-18
7.5
None Remote Low Not required Partial Partial Partial
SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.
23 CVE-2014-2749 200 +Info 2014-04-10 2014-04-24
5.0
None Remote Low Not required Partial None None
The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request.
24 CVE-2014-2748 264 2014-04-10 2014-04-24
7.5
None Remote Low Not required Partial Partial Partial
The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these details are obtained from third party information.
25 CVE-2014-1965 79 XSS 2014-02-14 2014-02-21
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP.
26 CVE-2014-1964 79 XSS 2014-02-14 2014-02-21
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error.
27 CVE-2014-1963 DoS 2014-02-14 2014-02-21
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors.
28 CVE-2014-1962 200 +Info 2014-02-14 2014-02-21
5.0
None Remote Low Not required Partial None None
Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.
29 CVE-2014-1961 +Info 2014-02-14 2014-02-21
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors.
30 CVE-2014-1960 264 +Info 2014-02-14 2014-02-21
5.0
None Remote Low Not required Partial None None
The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors.
31 CVE-2014-0984 264 1 2014-04-17 2014-04-24
4.3
None Remote Medium Not required Partial None None
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtrain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
32 CVE-2013-7367 264 +Priv 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privileges via unspecified vectors.
33 CVE-2013-7366 287 DoS 2014-04-10 2014-04-11
5.0
None Remote Low Not required None None Partial
The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications.
34 CVE-2013-7365 79 XSS 2014-04-10 2014-04-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
35 CVE-2013-7364 264 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors.
36 CVE-2013-7363 +Info 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the configuration of applications, and install or remove applications via vectors involving the P4 protocol.
37 CVE-2013-7362 94 Exec Code 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors.
38 CVE-2013-7361 22 Dir. Trav. 2014-04-10 2014-04-11
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors.
39 CVE-2013-7360 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors.
40 CVE-2013-7359 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in SAP Mobile Infrastructure allows remote attackers to obtain sensitive port information via unknown vectors, related to an "internal port scanning" issue.
41 CVE-2013-7358 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibly other identity information via unknown vectors.
42 CVE-2013-7357 +Info 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unknown vectors.
43 CVE-2013-7356 2014-04-10 2014-04-11
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors.
44 CVE-2013-7355 89 Exec Code Sql 2014-04-10 2014-04-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema.
45 CVE-2013-7096 89 Exec Code Sql 2013-12-13 2013-12-19
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
46 CVE-2013-7095 2013-12-13 2013-12-19
10.0
None Remote Low Not required Complete Complete Complete
The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.
47 CVE-2013-7094 89 Exec Code Sql 2013-12-13 2013-12-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
48 CVE-2013-7093 287 Bypass 2013-12-13 2013-12-16
5.0
None Remote Low Not required None Partial None
SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors.
49 CVE-2013-6869 89 Exec Code Sql 2013-11-23 2013-12-08
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
50 CVE-2013-6823 264 Bypass 2013-11-20 2013-11-20
6.4
None Remote Low Not required Partial Partial None
GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors.
Total number of vulnerabilities : 178   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.