CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

Code injection

In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to...

Design/Logic Flaw

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console CMC - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted...

Cross site scripting

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing...

Session fixation

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

Cross site scripting

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

Cross site scripting

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...

Code injection

In SAP Host Agent SAPOSCOL - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves...

CVE-2022-39014

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console CMC - version 430, allows an attacker to access certain unencrypted sensitive parameters which would otherwise be restricted...

CVE-2022-39014

CVE-2022-39014 affects SAP BusinessObjects BI Platform Central Management Console (CMC) 430. The issue is an information-disclosure vulnerability: under certain conditions an attacker could access unencrypted sensitive parameters that should be restricted. The public documents indicate the root c...

CVE-2022-39801

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

CVE-2022-39801

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

CVE-2022-39801

CVE-2022-39801 relates to SAP GRC Access Control Emergency Access Management. An authenticated attacker can access a Firefighter session after it is closed in the Firefighter Logon Pad, with exploitation possible only inside the firewall, potentially enabling access to an admin session and comple...

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...

CVE-2022-39799

CVE-2022-39799 affects SAP GUI for HTML within Fiori Launchpad. It enables an unauthenticated attacker to craft and deliver a reflected cross-site scripting (XSS) attack that can steal session information and impersonate the user. The CVE is referenced across multiple feeds (NVD, Red Hat, CVE Lis...

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...

CVE-2022-35298

Summary: CVE-2022-35298 affects SAP NetWeaver Enterprise Portal (KMC) 7.50. The vulnerability stems from insufficient encoding of user-controlled inputs in the KMC servlet, allowing Cross-Site Scripting. Affected component: SAP NetWeaver Enterprise Portal (KMC) servlet, version 7.50, running on t...

CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35294

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing...

CVE-2022-35294

CVE-2022-35294 describes a stored XSS vulnerability in SAP NetWeaver Application Server ABAP. An attacker with basic business user privileges can craft and upload a malicious file, which is downloaded and viewed by other users, allowing information disclosure (including potential credential theft...