CVE-2022-26104

CVE-2022-26104 concerns SAP Financial Consolidation 10.1, where the component responsible for homepage/maintenance system messages fails to perform necessary authorization checks. This could allow an unauthorized user to alter the maintenance system message. The description is consistent across m...

CVE-2022-41258

SAP Financial Consolidation 1010 is affected by an input-validation–driven cross-site scripting (XSS) vulnerability in the Web Administration Console. An authenticated attacker can inject malicious script when running a common query, potentially_VIEWing_ or modifying information with limited impa...

CVE-2022-41208

CVE-2022-41208 affects SAP Financial Consolidation version 1010. Connected sources confirm insufficient input validation allows an authenticated user with privileges to alter the current user session, enabling viewing or modifying information and exposing a limited impact to confidentiality and i...

CVE-2019-0370

CVE-2019-0370 affects SAP Financial Consolidation (before v10.0 and v10.1). The vulnerability arises from missing input validation, allowing crafted input to interfere with the structure of surrounding queries, resulting in an XPath Injection. The connected documents confirm the root cause (input...

CVE-2022-41260

CVE-2022-41260 affects SAP Financial Consolidation version 1010. The vulnerability arises from insufficient encoding of user-controlled input, enabling an unauthenticated attacker to inject a web script via a GET request. Successful exploitation could lead to viewing or modifying information, wit...

CVE-2019-0369

CVE-2019-0369 affects SAP Financial Consolidation prior to versions 10.0 and 10.1. The vulnerability arises because user-controlled inputs are not sufficiently encoded when uploading files containing scripts, enabling a reflected cross-site scripting (XSS) issue in the web application. Documents ...