SAP ICF Open-Redirect

In all versions of SAP ABAP Platform, SAP NetWeaver, SAP Web Application Server and SAP S/4HANA an Open Redirect exists via the 'redirecturl' parameter from the logoff page. This can be used to redirect the victim to a malicious URL. Cyber-criminals will abuse these vulnerabilities in social...

SAP NetWeaver AS ABAP Information Disclosure (3392547)

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase...

SUSE: Security Advisory (SUSE-SU-2023:4869-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:4824-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:4829-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Privilege Management

sap-xssec is vulnerable to Improper Privilege Management. The vulnerability arises due to the lack of permission checks in the library. This allows an attacker to gain arbitrary permissions within the application under specific conditions, resulting in privilege escalation...

Privilege Escalation

SAP BTP Security Services Integration Library is vulnerable to Privilege Escalation. The vulnerability exists due to the lack of permission checks in the library, enabling an attacker to obtain arbitrary permissions within the application under certain conditions...

SAP Biller Direct Cross-Site Scripting Vulnerability

SAP Biller Direct is a Web application from SAP Germany. It is used to present customer accounts in an Internet portal. A cross-site scripting vulnerability exists in SAP Biller Direct versions 635 and 750, which stems from the application's lack of effective filtering and escaping of user-suppli...

SAP Cloud Connector Resource Management Error Vulnerability

SAP Cloud Connector is a tool from SAP Germany to establish a secure connection between local systems and SAP Cloud Platform. A resource management error vulnerability exists in SAP Cloud Connector version 2.0, which stems from the presence of uncontrolled resource consumption in the application...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2023-100007)

SAP Business Objects is a business intelligence suite from SAP, Germany. A cross-site scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform 420 version 430, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be...

SAP HCM Travel Management Cross-Site Scripting Vulnerability

SAP HCM Travel Management is a travel management module from SAP. A cross-site scripting vulnerability exists in SAP HCM Travel Management that stems from insufficiently encoded user input and can be exploited by an attacker to cause a cross-site scripting XSS attack...

SUSE: Security Advisory (SUSE-SU-2023:4807-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:4789-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SAP Solution Manager Command Injection Vulnerability

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

SAP Emarsys SDK License Issue Vulnerability

SAP Emarsys SDK is a software development kit for Emarsys Mobile Apps from SAP. An authorization issue vulnerability exists in SAP Emarsys SDK version 3.6.2, which stems from a lack of proper authorization checking, and can be exploited by an attacker to invoke a specific activity and can forward...

SAP Master Data Governance Path Traversal Vulnerability

SAP Master Data Governance is a suite of data management tools from SAP Germany for maintaining, validating, and distributing master data. A path traversal vulnerability exists in SAP Master Data Governance, which stems from insufficient validation of user-supplied path information by the File...

Improper Privilege Management in sap-xssec

Impact SAP BTP Security Services Integration Library Python sap-xssec allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to patched version = 4.1.0 We always...

GHSA-6MJG-37CP-42X5 Improper Privilege Management in sap-xssec

Impact SAP BTP Security Services Integration Library Python sap-xssec allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to patched version = 4.1.0 We always...

Improper Privilege Management in github.com/sap/cloud-security-client-go

Impact SAP BTP Security Services Integration Library Golang github.com/sap/cloud-security-client-go allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to...

GHSA-M8RW-RCPQ-2VP2 Improper Privilege Management in github.com/sap/cloud-security-client-go

Impact SAP BTP Security Services Integration Library Golang github.com/sap/cloud-security-client-go allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to...