Input validation

Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative...

Path traversal

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

CVE-2022-32249

The CVE describes an information-disclosure vulnerability in SAP Business One and SAP HANA cockpit under specific integration scenarios. The root cause is insufficient access control in the Cockpit component, enabling a remote attacker to access the HANA cockpit’s data volume and obtain highly se...

CVE-2022-32249

Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly sensitive information e.g., high privileged account credentials...

CVE-2022-35224

Summary of CVE-2022-35224 (SAP Enterprise Portal) : A cross-site scripting (XSS) vulnerability in SAP Enterprise Portal versions 7.10–7.50 arises from insufficient encoding of user-controlled inputs, enabling attackers to non-permanently deface or modify portal content. If a victim browses with a...

CVE-2022-35224

SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. This attack can be used to non-permanently deface or modify portal content. The execution of script content by a...

CVE-2022-35228

SAP BusinessObjects Central Management Console (CMC) is affected by CVE-2022-35228. The issue allows an unauthenticated attacker to retrieve token information over the network under conditions where a legitimate user accesses the application and a local compromise (e.g., sniffing or social engine...

CVE-2022-35228

SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successfu...

CVE-2022-35225

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting XSS vulnerability, therefore changing the scope of the attack. This leads to limited impact on...

CVE-2022-35225

The CVE-2022-35225 vulnerability affects SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. It is a reflected Cross-Site Scripting issue caused by insufficient encoding of user-controlled inputs over the network, with reported impact described as limited on con...

CVE-2022-35227

CVE-2022-35227 — SAP NW EP (WPC) : A cross-site scripting vulnerability affects SAP NetWeaver EP (WPC) versions 7.30, 7.31, 7.40, and 7.50 due to inadequate validation of user-controlled input. A remote attacker could exploit this to run arbitrary script code, potentially stealing or modifying us...

CVE-2022-35227

A vulnerability in SAP NW EP WPC - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site XSS scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to...

CVE-2022-35172

SAP NetWeaver Enterprise Portal (versions 7.10–7.50) contains a reflected XSS vulnerability due to insufficient encoding of user-controlled inputs. Exploitation details (payloads, vectors) are not provided in the connected documents. The issue is documented across multiple feeds (NVD, Red Hat, CN...

CVE-2022-35172

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

CVE-2022-35171

CVE-2022-35171 affects SAP 3D Visual Enterprise Viewer. The vulnerability occurs when opening manipulated JPEG 2000 files (.jp2, jp2k.x3d) from untrusted sources, triggering an input validation error that crashes the application and leaves it temporarily unavailable until restart. The root cause ...

CVE-2022-35171

When a user opens manipulated JPEG 2000 .jp2, jp2k.x3d files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant...

CVE-2022-35169

SAP BusinessObjects Business Intelligence Platform LCM - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on...

CVE-2022-35169

SAP BusinessObjects Business Intelligence Platform (LCM) versions 420 and 430 are affected by CVE-2022-35169, where an administrator can read and decrypt the LCMBIAR file password under certain conditions. This could lead to password modification or importing the file into another system, with hi...

CVE-2022-35170

SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting XSS vulnerability, therefore changing the scope of the attack. This leads to limited impact on...

CVE-2022-35170

Summary of CVE-2022-35170 : Affected product is SAP NetWeaver Enterprise Portal (versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50). The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs transmitted over the network. The resulti...