CVE-2022-41259

CVE-2022-41259 affects SAP SQL Anywhere 17.0. An authenticated attacker can crash the server by sending queries that use the ARRAY constructor, resulting in a denial of service and availability impact. The CVSS base score is 6.5 (Medium); attack vector Network, low attack complexity, privileges r...

SAP NetWeaver和SAP NetWeaver Application Server 路径遍历漏洞

SAP NetWeaver and SAP NetWeaver Application Server are both products of SAP, a service-oriented, integrated application platform that provides a development environment for SAP applications. SAP NetWeaver is an integrated, service-oriented application platform that provides a development and...

CVE-2022-41211

Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload forces:Re-use of dangling pointer which refers to overwritte...

PT-2022-6134 · Sap · Sap Sql Anywhere

Name of the Vulnerable Software and Affected Versions: SAP SQL Anywhere version 17.0 Description: The issue is related to the lack of protection for the SQL query structure in SAP SQL Anywhere. An authenticated attacker can exploit this by crashing the server with specially crafted queries that u...

CVE-2022-41259

SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use an ARRAY constructor...

CVE-2022-41215

SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

SAP NetWeaver和SAP NetWeaver Application Server 输入验证错误漏洞

SAP NetWeaver and SAP NetWeaver Application Server are both products of SAP, a service-oriented, integrated application platform that provides a development environment for SAP applications. SAP NetWeaver is an integrated, service-oriented application platform that provides a development and...

CVE-2022-41258

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an attacker can view or modify information causing a limited...

CVE-2022-41205

SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application...

PT-2022-25730 · Sap · Sap Biller Direct

Name of the Vulnerable Software and Affected Versions: SAP Biller Direct affected versions not specified Description: The issue allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victi...

CVE-2022-41212

CVE-2022-41212 affects SAP NetWeaver Application Server ABAP and ABAP Platform. The root cause is insufficient input validation that enables an attacker with high privileges to invoke a remotely enabled function to read a file that is normally restricted, compromising confidentiality. The descrip...

CVE-2022-41260

CVE-2022-41260 affects SAP Financial Consolidation version 1010. The vulnerability arises from insufficient encoding of user-controlled input, enabling an unauthenticated attacker to inject a web script via a GET request. Successful exploitation could lead to viewing or modifying information, wit...

CVE-2022-41215

CVE-2022-41215 affects SAP NetWeaver ABAP Server and ABAP Platform. The issue is an unauthenticated URL redirection caused by insufficient URL validation, potentially tricking users into disclosing personal information. The vulnerability is categorized with CVSSv3.1 base score 4.7 (Medium) and in...

SAP Financial Consolidation 跨站脚本漏洞

SAP Financial Consolidation is a financial statement solution from SAP. The product is designed to automate intercompany reconciliations and offsets, currency conversions, and provide financial statement generation. A cross-site scripting vulnerability exists in SAP Financial Consolidation versio...

CVE-2022-41258

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an attacker can view or modify information causing a limited...

SAP Biller Direct 输入验证错误漏洞

SAP Biller Direct is a web application from SAP, Germany. It is used to present customer accounts in an Internet portal. SAP Biller Direct suffers from an input validation error vulnerability that stems from the fact that it allows an unauthenticated attacker to create a legitimate-looking URL...

CVE-2022-41214

Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integri...

CVE-2022-41208

CVE-2022-41208 affects SAP Financial Consolidation version 1010. Connected sources confirm insufficient input validation allows an authenticated user with privileges to alter the current user session, enabling viewing or modifying information and exposing a limited impact to confidentiality and i...

CVE-2022-41260

SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web script via a GET request. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality a...

CVE-2022-41212

Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to read a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the...