17806 matches found
CVE-2021-42067
In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information...
Design/Logic Flaw
In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information...
Design/Logic Flaw
SAP Enterprise Threat Detection ETD - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its...
Code injection
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being...
Information disclosure
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information...
Code injection
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified...
CVE-2021-42067
In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information...
CVE-2021-42067
CVE-2021-42067 affects SAP NetWeaver AS for ABAP and ABAP Platform (versions 701, 702, 711, 730–756, 786). An authenticated regular user can use the S/4 Hana dashboard to reveal systems and services they normally should not see; no data modification or service denial is indicated. The publicly av...
CVE-2022-22529
CVE-2022-22529 concerns SAP Enterprise Threat Detection (ETD) 2.0. Several sources confirm a vulnerability due to insufficient encoding of user‑controlled inputs, potentially enabling an XSS attack. ETD’s UI uses SAP UI5 standard controls, which provide automated output encoding for their control...
CVE-2022-22529
SAP Enterprise Threat Detection ETD - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its...
CVE-2022-22531
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified...
CVE-2022-22531
The CVE-2022-22531 relates to SAP S/4HANA, F0743 Create Single Payment application (versions 100–106). The root cause is that the module does not validate uploaded or downloaded files, enabling an attacker with basic user rights to execute arbitrary script code and potentially disclose or modify ...
CVE-2021-44234
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information...
CVE-2021-44234
The CVE relates to SAP Business One (v10.0) where the extended log stores information that can be of a sensitive nature, potentially exposing sensitive user information. Connected sources corroborate an information-disclosure issue affecting SAP Business One, with references indicating the vulner...
CVE-2022-22530
CVE-2022-22530 affects the SAP S/4HANA F0743 Create Single Payment application (versions 100–106). The issue is improper validation of uploaded/downloaded files, enabling a user with basic rights to inject dangerous content or malicious code, potentially modifying critical information and comprom...
CVE-2022-22530
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being...
SAP NetWeaver AS 安全漏洞
SAP NetWeaver AS is a SAP network application server from SAP. It not only provides web services, but is also the basic platform for SAP software. A security vulnerability exists in SAP NetWeaver AS that originates from an attacker authenticating as a regular user in SAP NetWeaver AS for ABAP and...
PT-2022-11540 · Sap · Sap Netweaver As Abap +2
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for ABAP and ABAP Platform versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786 Description: The issue allows an attacker, authenticated as a regular user, to use the S/4 Hana dashboard to reveal...
SAP NetWeaver AS ABAP Information Disclosure (January 2022)
An information disclosure vulnerability may be present in SAP NetWeaver Application Server ABAP. An authenticated attacker can use the S/4HANA dashboard to reveal systems and services which they would not normally be allowed to see. Note that Nessus has not tested for this issue but has instead...
