CVE-2022-26101

CVE-2022-26101 affects SAP Fiori launchpad, specifically versions 754–756, where insufficient encoding of user-controlled inputs leads to a Cross-Site Scripting (XSS) vulnerability. The issue is tied to the launchpad’s handling of input data (root cause: inadequate encoding), enabling script exec...

PT-2022-17671 · Sap · Sap Fiori Launchpad

Name of the Vulnerable Software and Affected Versions: SAP Fiori launchpad versions 754 through 756 Description: The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability. This allows for the execution of malicious scripts in th...

CVE-2022-26101: Improper Neutralization of Input During Web Page Generation

Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-17862

A cross-site scripting XSS vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sysjdbc parameter to /TestJDBCWeb/test2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2018-17862

A cross-site scripting XSS vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sysjdbc parameter to /TestJDBCWeb/test2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Cross site scripting

UNSUPPORTED WHEN ASSIGNED A cross-site scripting XSS vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sysjdbc parameter to /TestJDBCWeb/test2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2018-17862: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sysjdbc parameter to /TestJDBCWeb/test2. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2021-27605

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...

CVE-2021-27605

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...

CVE-2021-27605

Summary: CVE-2021-27605 affects SAP HCM Travel Management Fiori Apps V2 (608). The issue is an improper authorization check that permits an authenticated but unauthorized user to read personnel numbers, enabling privilege escalation. The attacker can access limited personnel data (last name, firs...

SAP HCM Travel Management 安全漏洞

SAP HCM Travel Management is a travel management module from SAP Germany. A security vulnerability exists in HCM Travel Management Fiori Apps V2 608, which stems from a failure to perform proper authorization checks and can be exploited by an attacker to read an employee's personnel number,...

PT-2021-17541

Name of the Vulnerable Software and Affected Versions SAP HCM Travel Management Fiori Apps V2 version 608 Description The issue allows an authenticated but unauthorized attacker to bypass authorization checks, resulting in the escalation of privileges. This enables the attacker to read certain...

CVE-2021-27605: Missing Authorization

SAP's HCM Travel Management Fiori Apps V2, version - 608, does not perform proper authorization check, allowing an authenticated but unauthorized attacker to read personnel numbers of employees, resulting in escalation of privileges. However, the attacker can only read some information like last...

SAP Fiori Launchpad Cross-Site Scripting Vulnerability

SAP Fiori is SAP's user experience UX design system for SAP applications, which provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, providing a consistent, innovative experience for creators and users.SAP Fiori Launchpad is the SA...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

Cross site scripting

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile (News tile Application) suffers a Reflected XSS in versions 750–755 due to insufficient encoding of user-controlled inputs, enabling an unauthenticated attacker to send malicious code that can be read and potentially modified in the victim’s browser. Impact per recor...

PT-2020-16510

Name of the Vulnerable Software and Affected Versions SAP Fiori Launchpad News tile Application versions 750 through 755 Description The issue allows an unauthorized attacker to send malicious code to a different end user victim using the SAP Fiori Launchpad News tile Application. This is due to...