CVE-2024-45283 Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)

SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but cannot modify or delete the data...

CVE-2024-45283

CVE-2024-45283 affects SAP NetWeaver AS for Java. An authorized attacker can obtain sensitive information (username/password) when creating an RFC destination, enabling read access to credentials without modification or deletion. Exploitation is described as a local attack with high confidentiali...

CVE-2024-45281

CVE-2024-45281 affects SAP BusinessObjects BI Platform. It describes a DLL hijacking vulnerability where a high-privilege local user can cause client desktop applications to run using unsigned or broken DLLs, compromising confidentiality and integrity. Local access is required; impact is high for...

CVE-2024-45281 DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This...

CVE-2024-45281 DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This...

CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280

SAP NetWeaver AS Java is affected by a Cross-Site Scripting (XSS) vulnerability in the login application caused by insufficient encoding of user-controlled inputs. The issue is exploitable over the network with user interaction required, and has limited impact on confidentiality and integrity (no...

CVE-2024-45279 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)

Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim'...

CVE-2024-45279 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)

Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim'...

CVE-2024-45279

CVE-2024-45279 affects the SAP NetWeaver Application Server for ABAP, specifically the CRM Blueprint Application Builder Panel. The issue is a Cross-Site Scripting (XSS) vulnerability caused by insufficient input validation that enables an unauthenticated attacker to craft a URL embedding malicio...

CVE-2024-44121 Information Disclosure in SAP S/4 HANA (Statutory Reports)

Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of th...

CVE-2024-44121 Information Disclosure in SAP S/4 HANA (Statutory Reports)

Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of th...

CVE-2024-44121

The CVE-2024-44121 entry describes an information-disclosure vulnerability in SAP S/4HANA Statutory Reports that, under certain conditions, allows a user with basic privileges to access restricted internal data. Affected software is SAP S/4HANA (Statutory Reports) with confidentiality impact note...

CVE-2024-44120 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the...

CVE-2024-44120

The CVE-2024-44120 entry concerns SAP NetWeaver Enterprise Portal, a SAP NetWeaver front-end component. It describes a reflected cross-site scripting (XSS) vulnerability caused by insufficient encoding of user-controlled input. An unauthenticated attacker can craft a malicious URL and entice a us...

CVE-2024-44120 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the...

CVE-2024-44117 Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform

The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application...

CVE-2024-41728

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects...

CVE-2024-41728

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects...