Cross site scripting

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete theme data, which could result in Stored Cross-Site Scripting XSS attack...

Authorization

SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2022-29616

CVE-2022-29616 affects SAP NetWeaver AS ABAP/AS Java kernel components (versions 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04) and SAP Host Agent/SAP NetWeaver platforms. The issue is a memory corruption due to logical errors in memory management, potentially exposing user authentic...

CVE-2022-29616

SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption...

CVE-2022-29613

Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application...

CVE-2022-29613

SAP Employee Self Service is affected by an input validation flaw that allows an authenticated user to change an employee number, enabling viewing of other users’ personal details and resulting in limited confidentiality impact. The root cause cited across sources is insufficient input validation...

CVE-2022-29611

SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2022-29611

CVE-2022-29611 refers to SAP NetWeaver AS ABAP/ABAP Platform missing authorization checks for an authenticated user, enabling privilege escalation. The issue is described in multiple sources as a missing authorization vulnerability within SAP NetWeaver Application Server ABAP/ABAP Platform. The p...

CVE-2022-29610

SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete theme data, which could result in Stored Cross-Site Scripting XSS attack...

CVE-2022-29610

Summary: CVE-2022-29610 affects SAP NetWeaver Application Server ABAP. An authenticated attacker can upload malicious files and delete data, enabling a Stored Cross-Site Scripting (XSS) attack due to inadequate input validation. Multiple connected sources corroborate this CVE and describe the sam...

CVE-2022-28774

Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted...

CVE-2022-28774

The CVE-2022-28774 entry involves SAP Host Agent and describes an information disclosure vulnerability in the SAP Host Agent logfile under certain conditions. Affected component is the SAP Host Agent, with the root cause being unintended sensitive data exposure in log files. Impact is information...

CVE-2022-28214

During an update of SAP BusinessObjects Enterprise, Central Management Server CMS - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integrity, and Availability...

CVE-2022-28214

CVE-2022-28214 affects SAP BusinessObjects Enterprise CMS (versions 420 and 430). During an update, authentication credentials are exposed in Sysmon event logs, causing Information Disclosure with high impact to Confidentiality, Integrity, and Availability. The NVD/NVD-derived metrics list CVSSv3...

CVE-2022-27656

CVE-2022-27656 affects SAP Web Dispatcher Web Administration UI and the Internet Communication Manager (ICM). It stems from insufficient encoding of user‑controlled inputs, enabling Cross‑Site Scripting (XSS). CVSS v3.1 base score 6.1 (MEDIUM); vectors: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. No exp...

CVE-2022-27656

The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager ICM does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

PT-2022-19223 · Sap · Sap Host Agent

Name of the Vulnerable Software and Affected Versions: SAP Host Agent affected versions not specified Description: The issue concerns the SAP Host Agent logfile, which under certain conditions, displays information that would otherwise be restricted. Recommendations: At the moment, there is no...

SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE) Vulnerability

Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213 References:...

SAP BusinessObjects Intelligence 4.3 XML Injection

Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Date: 4/21/2022 Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213...

SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)

Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity XXE Google Dork: N/A Date: 4/21/2022 Exploit Author: West Shepherd Vendor Homepage: https://www.sap.com/ Software Link: https://www.sap.com/ Version: 4.2 and 4.3 Tested on: Windows Server 2019 x64 CVE : CVE-2022-28213...