CVE-2021-40502

SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from b2b units they do not belong to...

CVE-2021-40502

CVE-2021-40502 affects SAP Commerce versions 2105.3, 2011.13, 2005.18, and 1905.34. The issue stems from missing authorization checks for an authenticated user, enabling privilege escalation to access and edit data from B2B units the user does not belong to. The NVD entry lists CVSS v3.1 base sco...

CVE-2021-40501

CVE-2021-40501 affects SAP ABAP Platform Kernel versions 7.77, 7.81, 7.85, 7.86. The root cause is missing authorization checks for an authenticated business user, enabling privilege escalation (read/modify data beyond the vulnerable system). The exploitation details are not provided in the conne...

CVE-2021-40501

SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker...

PT-2021-22911 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue concerns a certain template role in SAP NetWeaver Application Server for ABA...

SUSE: Security Advisory (SUSE-SU-2021:3637-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:3635-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SAP GUI 信息泄露漏洞

SAP GUI is an application from SAP, a German company. graphical user interface for SAP systems. An information disclosure vulnerability exists in SAP GUI for Windows, which arises from the application exporting too much data. A remote user could gain unauthorized access to sensitive system...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in the following products: SAP ABAP Platform Kernel SAP Commerce SAP ERP Financial Accounting SAP ERP HCM Portugal SAP Focused SAP GUI for Windows SAP NetWeaver Application Server for ABAP and ABAP Platform. SAP Solution Manager The vulnerabilities potentially enable...

SAP Business Technology Platform信息泄露漏洞

SAP Business Technology Platform is a business technology platform from SAP Germany that integrates intelligent enterprise applications with database and data management, analytics, integration and extension capabilities into a single platform for cloud and hybrid environments, including hundreds...

SAP Releases November 2021 Security Updates

SAP has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the SAP Security Notes for November 2021 and apply the...

SAP NetWeaver Application Server 权限许可和访问控制问题漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A privilege permission and access control issue vulnerability exists in SAP NetWeaver Application Server, which arises from an application that does not properly impose security restrictions. The vulnerability can be...

CVE-2021-41251

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some...

CVE-2021-41251

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some...

Design/Logic Flaw

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some...

CVE-2021-41251

The vulnerability CVE-2021-41251 affects the SAP Cloud SDK core used in SAP Business Technology Platform apps, specifically when destination caching is enabled. The root cause is that, in certain versions, cached destinations could be stored without user identity information, allowing other users...

CVE-2021-41251 Possibility to elevate privileges or get unauthorized access to data

@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some...

SUSE: Security Advisory (SUSE-SU-2021:3613-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SAP NetWeaver AS Java XXE Vulnerability (2296909)

An XML external entity XXE vulnerability exists in BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5. An authenticated, remote attacker can exploit this, to conduct XML External Entity XXE attacks via the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI, aka SAP Security Note 2296909. Note that Nessu...

SAP NetWeaver AS Java Directory Traversal Vulnerability (2547431)

A directory traversal vulnerability exists in SAP Netweaver Application Server Java CRM versions before 7.01, 7.02, 7.30, 7.31, 7.33, 7.54 due to insufficient validation of path information provided by users, thus characters representing traverse to parent directory are passed through to the file...