CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

Code injection

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which...

CVE-2021-21468

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table...

Sql injection

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

CVE-2021-21466

CVE-2021-21466 affects SAP Business Warehouse (versions 700–750, 782) and SAP BW/4HANA (100–200). The issue enables a low-privileged attacker to inject code via a remote-enabled SAP function module, allowing creation of a malicious ABAP report to access sensitive data, inject UPDATE statements (p...

CVE-2021-21465

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. An attacker can include their own SQL commands which the database will execute without properly sanitizing the untrusted data leading to SQL injection...

CVE-2021-21465

CVE-2021-21465 affects SAP BW Database Interface. The vulnerability arises from improper sanitization of untrusted data, allowing an attacker with low privileges to craft SQL queries that the backend database will execute, potentially fully compromising the SAP system. Connected sources corrobora...

CVE-2021-21468

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges that allows the user to practically read out any database table...

CVE-2021-21468

CVE-2021-21468 affects the BW Database Interface in SAP BW, where missing authorization for an authenticated user allows privilege escalation to read arbitrary database tables. Documented impact: unauthorized data access via read of any table; no explicit exploit details provided here. Public ref...

PT-2021-14534 · Sap · Sap Business Warehouse +1

Name of the Vulnerable Software and Affected Versions: SAP Business Warehouse versions 700 through 750, 782 SAP BW/4HANA versions 100 through 200 Description: The issue allows a low-privileged attacker to inject code using a remote-enabled function module over the network. This can lead to the...

PT-2021-14536 · Unknown · Bw Database Interface

Name of the Vulnerable Software and Affected Versions: BW Database Interface affected versions not specified Description: The issue is related to the BW Database Interface not performing necessary authorization checks for an authenticated user. This results in an escalation of privileges, allowin...

CVE-2020-26838

SAP BW/ BW4HANA are affected by a code-injection vulnerability (CVE-2020-26838) that can be exploited by an authenticated attacker with high developer privileges through a crafted request to execute OS commands. Affected versions include SAP Business Warehouse (700, 701, 702, 731, 740, 750, 751, ...

gubelin.com.server26.zrh1.bw-server.ch Cross Site Scripting vulnerability OBB-1435464

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

libtiff: Two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c

A vulnerability was found in LibTIFF, where an out-of-bounds write in the cpTags function in tools/tiff2bw.c and tools/pal2rgb.c could lead to a denial of service., anattacker could exploit this flaw by convincing a victim to open a specially crafted file, potentially causing the application to...

Authorization

Under some circumstances, masterdata maintenance in SAP BW/4HANA fixed in DW4CORE version 1.0 SP08 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2019-0243

Under some circumstances, masterdata maintenance in SAP BW/4HANA fixed in DW4CORE version 1.0 SP08 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2019-0243

CVE-2019-0243 affects SAP BW/4HANA: masterdata maintenance can skip authorization checks for an authenticated user, enabling privilege escalation. Vulnerable component is masterdata maintenance in SAP BW/4HANA; fixed in DW4CORE version 1.0 (SP08). The issue implies unauthorized elevation of privi...

CVE-2019-0243

Under some circumstances, masterdata maintenance in SAP BW/4HANA fixed in DW4CORE version 1.0 SP08 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

XML External Entity Injection (XXE)

bw-calendar-engine-impl is vulnerable to XML external entity injection XXE. The vulnerability exists since the IscheduleClient XML parser does not restrict external DTDs which would allow an attacker to perform XXE attacks via a crafted XML document...

XML External Entity (XXE) vulnerability in bw-calendar-engine

bw-calendar-engine version = bw-calendar-engine-3.12.0 contains a XML External Entity XXE vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious...