CVE-2024-32730

SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the...

CVE-2024-33006 File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system...

CVE-2024-33006 File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system...

CVE-2024-33004

CVE-2024-33004 affects SAP Business Objects Business Intelligence Platform. The issue is insecure storage: dynamic web pages are cached after logout, allowing an attacker to view cached pages and open them, with a limited impact on confidentiality, integrity and availability. The initial descript...

CVE-2024-33004 Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)

SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on...

CVE-2024-33004 Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)

SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on...

CVE-2024-33009 SQL injection vulnerability in SAP Global Label Management (GLM)

SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could lead to low impact on Confidentiality and Integrity of the...

CVE-2024-33009

CVE-2024-33009 affects SAP Global Label Management (GLM). The vulnerability is a SQL injection due to insufficient input validation, enabling an attacker to modify database commands and retrieve additional data persisted by the system. The impact is described as low for confidentiality and integr...

CVE-2024-33009 SQL injection vulnerability in SAP Global Label Management (GLM)

SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could lead to low impact on Confidentiality and Integrity of the...

CVE-2024-34687 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, includin...

CVE-2024-34687 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, includin...

CVE-2024-34687

CVE-2024-34687 affects SAP NetWeaver Application Server for ABAP and ABAP Platform. The vulnerability is an XSS issue caused by insufficient encoding of user-controlled inputs, potentially allowing an attacker to inject code that runs in a user’s browser. Impact aligns with the vuln description: ...

CVE-2024-4138 Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)

Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application...

CVE-2024-4138 Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)

Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application...

CVE-2024-4139 Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)

Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and...

CVE-2024-28165 Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application...

CVE-2024-28165

CVE-2024-28165 affects SAP BusinessObjects Business Intelligence Platform. It is a stored XSS vulnerability where an attacker manipulates the Opendocument URL parameter due to input validation issues, with high impact on confidentiality and integrity. Exploitation would require a user to click a ...

CVE-2024-28165 Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application...

CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)

Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...

CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)

Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...