CVE-2023-29110

The CVE-2023-29110 issue affects SAP Application Interface (Message Dashboard) across multiple releases: AIF 703, AIFX 702, S4CORE 100/101, SAP_BASIS 755/756, SAP_ABA 75C/75D/75E. The root cause is that the application allows unrestricted HTML markup, enabling an authorized attacker to use basic ...

CVE-2020-6181

CVE-2020-6181 affects SAP NetWeaver SAP_BASIS (702, 730, 731, 740) and SAP ABAP Platform SAP_BASIS (750–754). The SAML SSO implementation may include invalidated data in HTTP response headers, enabling HTTP Response Splitting. Impact is a header-level manipulation in Web users; exact exploit deta...

CVE-2024-22131

CVE-2024-22131 affects SAP ABA (Application Basis) across versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I. The issue enables an authenticated user with remote execution privileges to use a vulnerable interface to invoke application functions beyond normal permissions, potentially readin...

CVE-2023-25615

SAP ABAP Platform SQL Injection (CVE-2023-25615): Affected versions include 751, 753, 754, 756, 757, 791. Root cause is insufficient input sanitization; an authenticated high-privileged user can inject malicious database queries over the network to alter the current session and access unintended ...

CVE-2021-44231

The CVE-2021-44231 issue is linked to SAP NetWeaver AS ABAP (and related ABAP server components) with a code-injection vulnerability in internally used text-extraction reports. The connected Nessus entry for SAP NetWeaver ABAP (3119365) describes a vulnerability where an attacker could inject cod...

CVE-2024-27900

CVE-2024-27900 affects SAP ABAP Platform (versions 758 and 795). The vulnerability stems from a missing authorization check that allows a user with a business- user account to change a job template’s privacy setting from shared to private, restricting access to the owner. Documented impact confir...

CVE-2020-6296

SAP NetWeaver ABAP Server/ABAP Platform (versions 700–755 listed) is affected by CVE-2020-6296, enabling code injection via a vulnerability in the application that could let an attacker control behavior. Connected sources confirm the root cause is code injection in these components. Exploitation ...

CVE-2020-6280

SAP NetWeaver ABAP Server/ABAP Platform, versions 731, 740, 750, are affected by an information-disclosure vulnerability where an admin user can access restricted files. Root cause described as improper access control; no public exploit details in the provided documents. Workarounds exist: PR not...

CVE-2020-6299

CVE-2020-6299 affects SAP NetWeaver ABAP Server and ABAP Platform (versions 740–755). The issue enables a business user to retrieve the system’s user list via the value help feature, causing information disclosure. Root cause is insufficient access control exposing user lists; no exploit details ...

CVE-2020-6318

CVE-2020-6318 is a remote code execution vulnerability in SAP NetWeaver ABAP Server (up to 7.40) and ABAP Platform (>= 7.40). An attacker can exploit via code injection to potentially take full control, including data access/modification, per multiple sources. Exploitation details are not desc...

CVE-2020-6310

CVE-2020-6310 affects SAP NetWeaver (ABAP Server) and ABAP Platform versions 702, 730, 731, 740, 750. The issue is improper access control in the SOA Configuration Trace component, enabling any authenticated user to enumerate SAP users, resulting in information disclosure. Connected sources corro...

CVE-2023-29109

CVE-2023-29109 affects SAP Application Interface Framework (Message Dashboard) across AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755/756, SAP_ABA 75C/75D/75E. The root cause is an Excel formula injection in fields such as the Tooltip of the Custom Hints List, which can execute when the victim opens...