Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
525 results · page 3 of 11
Mar 10, 2025User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS).CVE-2025-27431 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or unauthorized data modifications within the scope of victim�s browser. There is no impact on availability.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalCVE-2025-26661 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.
- Product
- SAP NetWeaver (ABAP Class Builder)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability.CVE-2025-26659 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerabilCVE-2025-25242 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting.CVE-2025-23194 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application.
- Product
- SAP NetWeaver Enterprise Portal (OBN component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XCVE-2025-24869 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of CVE-2025-23193 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.
- Product
- SAP NetWeaver Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherCVE-2025-23190 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.
- Product
- SAP NetWeaver and ABAP platform (ST-PI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data.CVE-2025-23189 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data.CVE-2025-23187 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability.CVE-2025-0054 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper CVE-2025-0070 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks.CVE-2025-0068 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo conneCVE-2025-0067 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due CVE-2025-0066 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application
- Product
- SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules.CVE-2025-0063 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability.CVE-2025-0059 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability.CVE-2025-0057 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.
- Product
- SAP NetWeaver AS JAVA (User Admin Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information.CVE-2025-0053 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinCVE-2024-54198 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.5
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially craftiCVE-2024-54197 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.2
SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in Server-Side Request Forgery (SSRF) which could have a low impact on integrity and confidentiality of data. It has no impact on availability of the application.
- Product
- SAP NetWeaver Administrator(System Overview)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting imCVE-2024-47585 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitation, this can result in potential security concerns. However, it has no impact on the integrity and availability of the application and may have only a low impact on data confidentiality.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack.CVE-2024-47582 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.
- Product
- SAP NetWeaver AS JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment.CVE-2024-47580 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server.CVE-2024-47579 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application.CVE-2024-47578 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.CVE-2024-47593 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs.CVE-2024-47592 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.
- Product
- SAP NetWeaver Application Server Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext toCVE-2024-47588 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.
- Product
- SAP NetWeaver Java (Software Update Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a nuCVE-2024-47586 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD conCVE-2024-42372 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver AS Java (System Landscape Directory)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet.CVE-2024-47594 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim who is registered on the portal clicks on such link, confidentiality and integrity of their web browser session could be compromised.
- Product
- SAP NetWeaver Enterprise Portal (KMC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes.CVE-2024-45285 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information.CVE-2024-45283 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but cannot modify or delete the data.
- Product
- SAP NetWeaver AS for Java (Destination Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application.CVE-2024-45280 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.
- Product
- SAP NetWeaver AS Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker toCVE-2024-45279 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input.CVE-2024-44120 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the attacker could read and manipulate user content in the browser.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ICVE-2024-44117 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contCVE-2024-41728 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.7
Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites.CVE-2024-44116 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites.CVE-2024-44115 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network.CVE-2024-44114 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2
SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each nodeCVE-2024-42380 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user.CVE-2024-42371 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted.CVE-2024-41729 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application.
- Product
- SAP NetWeaver BW (BEx Analyzer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, wCVE-2024-41734 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls.CVE-2024-41732 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read or modify information. There is no impact on availability of application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP CCVE-2024-33005 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Application Server (ABAP and Java), and SAP Content Server can impersonate other users and may perform some unintended actions. This could lead to a low impact on confidentiality and a high impact on the integrity and availability of the applications.
- Product
- SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API CVE-2024-39599 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This leads to a low impact on the application's confidentiality, integrity, and availability.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furtherCVE-2024-37180 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.