CVE-2013-7358

Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibly other identity information via unknown vectors...

CVE-2019-0386

Order processing in SAP ERP Sales corrected in SAPAPPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and S4HANA Sales corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04 does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges...

CVE-2012-1291

Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servletjsp service...

CVE-2012-1290

Cross-site scripting XSS vulnerability in b2b/auction/container.jsp in the Internet Sales crm.b2b module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the loadPage parameter...

CVE-2019-0367

SAP NetWeaver Process Integration B2B Toolkit, before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check...

CVE-2019-0305

Java Server Pages JSPs provided by the SAP NetWeaver Process Integration SAPXIESR and SAPXITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability...

CVE-2011-5154

Multiple untrusted search path vulnerabilities in 1 SAPGui.exe and 2 BExAnalyzer.exe in SAP GUI 6.4 through 7.2 allow local users to gain privileges via a Trojan horse MFC80LOC.DLL file in the current working directory, as demonstrated by a directory that contains a .sap file. NOTE: some of these...

CVE-2013-3244

Multiple unspecified vulnerabilities in the CJDBFILLMEMORYFROMPPB function in the Project System PS-IS module for SAP ERP Central Component ECC allow remote attackers to execute arbitrary code via a 1 RFC or 2 SOAP-RFC request...

CVE-2014-8666

The User & Server configuration, InfoView refresh, user rights BI-BIP-ADM component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors...

CVE-2014-8665

The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files...

CVE-2013-7361

Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors...

CVE-2013-7362

An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors...

CVE-2015-8029

SAP 3D Visual Enterprise Viewer VEV allows remote attackers to execute arbitrary code via a crafted Filmbox document, which triggers memory corruption...

CVE-2013-6866

SAP Sybase Adaptive Server Enterprise ASE before 15.0.3 ESD4.3, 15.5 before 15.5 ESD5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR736689...

CVE-2013-6861

Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise ASE 15.0.3 before 15.0.3 ESD4.3, 15.5 before 15.5 ESD5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users to obtain sensitive information via unspecified vectors...

CVE-2012-1292

Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors...

CVE-2009-3345

Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author...

CVE-2003-0943

web-tools in SAP DB before 7.4.03.30 installs several services that are enabled by default, which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases via 1 waecho, 2 Web SQL Interface websql, or 3 Web Database Manager webdbm...

CVE-2003-0941

web-tools in SAP DB before 7.4.03.30 allows remote attackers to access the Web Agent Administration pages and modify configuration via a direct request to waadmin.wa...

CVE-2006-7220

Unspecified vulnerability in SAP SAPLPD and SAPSPRINT allows remote attackers to cause a denial of service application crash via a certain print job request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...