Vulnerabilities (CVE)

Filtered by vendor Sap Subscribe
Total 1496 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2003-0945 1 Sap 1 Sap Db 2025-04-03 7.5 HIGH N/A
The Web Database Manager in web-tools for SAP DB before 7.4.03.30 generates predictable session IDs, which allows remote attackers to conduct unauthorized activities.
CVE-2003-0748 1 Sap 1 Internet Transaction Server 2025-04-03 5.0 MEDIUM N/A
Directory traversal vulnerability in wgate.dll for SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the ~theme parameter and a ~template parameter with a filename followed by space characters, which can prevent SAP from effectively adding a .html extension to the filename.
CVE-2003-1038 1 Sap 1 Internet Transaction Server 2025-04-03 5.0 MEDIUM N/A
The AGate component for SAP Internet Transaction Server (ITS) allows remote attackers to obtain sensitive information via a ~command parameter with an AgateInstallCheck value, which provides a list of installed DLLs and full pathnames.
CVE-2003-0940 1 Sap 1 Sap Db 2025-04-03 5.0 MEDIUM N/A
Directory traversal vulnerability in sqlfopenc for web-tools in SAP DB before 7.4.03.30 allows remote attackers to read arbitrary files via .. (dot dot) sequences in a URL.
CVE-2003-0941 1 Sap 1 Sap Db 2025-04-03 7.5 HIGH N/A
web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa.
CVE-2003-1033 1 Sap 1 Sap Db 2025-04-03 7.2 HIGH N/A
The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.
CVE-2020-6287 1 Sap 1 Netweaver Application Server Java 2025-03-13 10.0 HIGH 10.0 CRITICAL
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CVE-2020-6207 1 Sap 1 Solution Manager 2025-03-13 10.0 HIGH 9.8 CRITICAL
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
CVE-2022-22536 1 Sap 3 Content Server, Netweaver Application Server Abap, Web Dispatcher 2025-03-13 10.0 HIGH 10.0 CRITICAL
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
CVE-2021-38163 1 Sap 1 Netweaver 2025-03-13 9.0 HIGH 9.9 CRITICAL
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
CVE-2018-2380 1 Sap 1 Customer Relationship Management 2025-03-12 6.5 MEDIUM 6.6 MEDIUM
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CVE-2024-27902 1 Sap 1 Netweaver As Abap 2025-02-26 N/A 5.4 MEDIUM
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
CVE-2024-22133 1 Sap 1 Fiori Front End Server 2025-02-26 N/A 4.6 MEDIUM
SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the application.
CVE-2024-27900 1 Sap 1 Abap Platform 2025-02-26 N/A 4.3 MEDIUM
Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner.
CVE-2024-25642 1 Sap 1 Cloud Connector 2025-02-13 N/A 7.4 HIGH
Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system.
CVE-2024-22126 1 Sap 1 Netweaver Application Server Java 2025-02-11 N/A 6.1 MEDIUM
The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.
CVE-2024-22127 1 Sap 1 Netweaver Application Server Java 2025-02-07 N/A 9.1 CRITICAL
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.
CVE-2024-25645 1 Sap 1 Netweaver Enterprise Portal 2025-02-07 N/A 5.3 MEDIUM
Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application.
CVE-2024-28163 1 Sap 1 Netweaver Process Integration 2025-02-07 N/A 5.3 MEDIUM
Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.
CVE-2024-27898 1 Sap 1 Netweaver 2025-02-06 N/A 5.3 MEDIUM
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.