SAP Financial Consolidation 跨站脚本漏洞

SAP Financial Consolidation is a financial statement solution from SAP. The product is designed to automate intercompany reconciliations and offsets, currency conversions, and provide financial statement generation. A cross-site scripting vulnerability exists in SAP Financial Consolidation versio...

SAP SQL Anywhere 安全漏洞

SAP SQL Anywhere is an SAP-specific relational database management system from SAP, Germany. A security vulnerability in SAP SQL Anywhere version 17.0 exists because it allows an authenticated attacker to prevent legitimate users from accessing the SQL Anywhere database server by crashing the...

PT-2022-25728 · Sap · Sap Gui

Name of the Vulnerable Software and Affected Versions: SAP GUI affected versions not specified Description: The issue allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries, which can cause a limited impact ...

CVE-2022-41207

SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victim to a malicious site of the attacker's choosing which can result in disclosure or modification of the victim'...

CVE-2022-41207

SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victim to a malicious site of the attacker's choosing which can result in disclosure or modification of the victim'...

CVE-2022-41207

The CVE-2022-41207 entry concerns SAP Biller Direct and describes an unauthenticated open redirect vulnerability where an unsensitized parameter in a crafted URL can redirect victims to a malicious site, potentially enabling disclosure or modification of victim information. Connected sources cons...

CVE-2022-41214

Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integri...

CVE-2022-41208

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user session. On successful exploitation, the attacker can view or modify information, causing a limited impact on confidentiality and integrity...

CVE-2022-41211

Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload forces:Re-use of dangling pointer which refers to overwritte...

CVE-2022-41205

SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application...

CVE-2022-41203

In some workflow of SAP BusinessObjects BI Platform Central Management Console and BI LaunchPad, an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted...

PT-2022-25735 · Sap · Sap Netweaver Abap Server +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform affected versions not specified Description: The issue allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being...

CVE-2022-41208

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user session. On successful exploitation, the attacker can view or modify information, causing a limited impact on confidentiality and integrity...

SAP NetWeaver和SAP NetWeaver ABAP Server 输入验证错误漏洞

SAP NetWeaver and SAP NetWeaver ABAP Server are products of SAP, Germany.SAP NetWeaver is an integrated service-oriented application platform that provides a development environment for SAP applications. SAP NetWeaver is an integrated, service-oriented application platform that provides a...

CVE-2022-41214

CVE-2022-41214 affects SAP NetWeaver Application Server ABAP and ABAP Platform. The root cause, as described across multiple sources, is insufficient input validation that enables a user with high privileges to invoke a remote-enabled function to delete a file that would normally be restricted. S...

PT-2022-25726 · Sap · Sap Businessobjects Bi Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects BI Platform affected versions not specified Description: The issue allows an authenticated attacker with low privileges to intercept a serialized object in the parameters and substitute it with a malicious serialized objec...

CVE-2022-41258

SAP Financial Consolidation 1010 is affected by an input-validation–driven cross-site scripting (XSS) vulnerability in the Web Administration Console. An authenticated attacker can inject malicious script when running a common query, potentially_VIEWing_ or modifying information with limited impa...

SAP Financial Consolidation 跨站脚本漏洞

SAP Financial Consolidation is a financial statement solution from SAP. The product is designed to automate intercompany reconciliations and offsets, currency conversions, and provide financial statement generation. A cross-site scripting vulnerability exists in SAP Financial Consolidation versio...

CVE-2022-41205

Technical details (affected products/versions/root cause/mitigation/patch specifics) are not publicly provided in the connected documents. Monitor for updates from SAP and security advisories.

CVE-2022-41211

The CVE-2022-41211 issue concerns SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, specifically in the parsing of DST files. Connected sources describe a Use-After-Free vulnerability in DST file parsing that can lead to Remote Code Execution. Exploitation typically requires us...