26 matches found
CVE-2026-89108
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...
CVE-2026-76972
Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...
CVE-2026-89108
SAP Manufacturing Integration and Intelligence (Configuration Service) contains a missing authorization check (CWE-862) within certain administrative functionalities. An attacker possessing MII administrator privileges can submit a specially crafted request to provision an account with elevated p...
CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...
EUVD-2026-98191
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...
CVE-2026-76972
A Cross-Site Scripting (XSS) vulnerability exists in SAP Manufacturing Integration and Intelligence (CWE-79). The root cause is the improper neutralization of input during web page generation, allowing an attacker to store malicious content that is subsequently rendered by the application. If an ...
CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence
Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...
EUVD-2026-98185
Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...
CVE-2026-76971: Server-Side Request Forgery (SSRF)
Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...
CVE-2026-44763: Improper Limitation of a Pathname to a Restricted Directory
SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...
CVE-2026-44758: Improper Control of Generation of Code
SAP Manufacturing Integration and Intelligence MII allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the...
CVE-2026-58244: Missing Authorization
SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...
CVE-2026-44764: Missing Authorization
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations...
CVE-2026-44765: Missing Authorization
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve,...
EUVD-2019-1040
Malware in sbrugna...
EUVD-2015-8213
Malware in sbrugna...
CVE-2019-0267: Cross-Site Request Forgery (CSRF)
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, Illuminator Servlet currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application...
PT-2019-4570
Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence versions 15.0 through 15.2 Description The issue is related to the lack of Anti-XSRF tokens in the Illuminator Servlet, which could lead to cross-site request forgery XSRF attacks if data is poste...
CVE-2016-4016
Cross-site scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence aka MII, formerly xMII 15 allows remote attackers to inject arbitrary web script or HTML via the title parameter to webdynpro/resources/sap.com/xappsxmiiuiadminnavigation/NavigationApplication, aka SAP Securi...
CVE-2016-4016
CVE-2016-4016: SAP Manufacturing Integration Intelligence (MII / xMII) 15 is affected by a reflected cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script via the title parameter of the NavigationApplication URL (webdynpro/resources/sap.com/xapps~xmii~ui~admin~navigati...