CVE-2023-40309

CVE-2023-40309 affects SAP CommonCryptoLib and is caused by insufficient authentication checks, enabling possible privilege escalation for an authenticated user and potential reading/modification/deletion of restricted data. The vulnerability is rated CRITICAL (CVSSv3.1: 9.8, AV:N/AC:L/PR:N/UI:N/...

CVE-2022-29612

CVE-2022-29612 affects SAP NetWeaver/ABAP Platform and SAP Host Agent, specifically Kernel sapcontrol startservice. Authenticated users can misuse this webfunctionality to retrieve restricted technical information (e.g., system number, physical address), yielding a limited confidentiality impact....

CVE-2022-28774

The CVE-2022-28774 entry involves SAP Host Agent and describes an information disclosure vulnerability in the SAP Host Agent logfile under certain conditions. Affected component is the SAP Host Agent, with the root cause being unintended sensitive data exposure in log files. Impact is information...

CVE-2022-29614

Summary: CVE-2022-29614 describes a local privilege-escalation vulnerability in the SAP startservice s-bit helper sapuxuserchk on Unix systems, affecting SAP NetWeaver AS ABAP, Application Server Java, ABAP Platform and HANA Database. The issue is triggered by physical access and can lead to priv...

CVE-2022-35295

CVE-2022-35295 affects SAP Host Agent (SAPOSCOL) 7.22. A privilege-escalation flaw arises from using files created by saposcol, enabling an attacker to escalate to higher privileges and potentially access confidential data. The issue is documented across multiple sources; exploitation details are...

CVE-2023-40308

The CVE-2023-40308 issue affects SAP CommonCryptoLib and is caused by memory corruption triggered by an unauthenticated crafted request sent to an open port. The resulting crash makes the target component unavailable, with no impact on confidentiality or integrity reported. Evidence across multip...

CVE-2023-0012

CVE-2023-0012 affects SAP Host Agent (Windows) versions 7.21 and 7.22 . A local attacker who gains membership in SAP_LocalAdmin can replace executables with a malicious file that runs under a privileged account, enabling local privilege escalation. By default, SAP_LocalAdmin members are denied lo...

CVE-2023-27498

The CVE-2023-27498 issue affects SAP Host Agent (SAPOSCOL) version 7.22. An unauthenticated attacker with network access can send crafted requests to the SAP Start Service port, causing memory corruption. This can disclose server information (confidentiality: LOW) and briefly render a service una...

CVE-2023-24523

Summary: CVE-2023-24523 affects SAP Host Agent (Start Service) version 7.21 and 7.22. A non-admin user with local access can trigger ConfigureOutsideDiscovery to execute an OS command with administrator privileges, enabling read/modify of any user or system data and potentially making the system ...

CVE-2020-6186

Summary (CVE-2020-6186): SAP Host Agent, v7.21, is reported to allow an attacker to slow down processing of username/password authentication, causing a Denial of Service. The connected sources corroborate a DoS impact from reduced authentication throughput, with no explicit exploitation details o...

CVE-2020-6234

Summary of the CVE : CVE-2020-6234 concerns SAP Host Agent, version 7.21. The vulnerability exists in the operation framework and enables a user with admin privileges to escalate to root on the underlying operating system. The impact is privilege escalation with a high severity rating (CVSS v3.1 ...

CVE-2020-6183

CVE-2020-6183 affects SAP Host Agent, version 7.21. The connected documents describe a vulnerability in which an unprivileged user can read or write the shared memory by sending a request to the main SAPOSCOL process, potentially exposing data such as directory sizes and hardware/OS details due t...

CVE-2023-36926

Summary : SAP Host Agent 7.22 has an information-disclosure flaw due to a missing authentication check, allowing an unauthenticated attacker to set an undocumented parameter to a compatibility value and invoke read functions to expose non-sensitive server information. The impact is limited to inf...

CVE-2024-47595

CVE-2024-47595 is a Local Privilege Escalation in SAP Host Agent. An attacker with membership in the sapsys group can replace local files usually protected by privileged access, impacting confidentiality and integrity of the application. Public details present in multiple sources confirm the loca...

CVE-2017-15297

CVE-2017-15297 concerns SAP Hostcontrol where the SOAP SAPControl endpoint does not require authentication, enabling unauthenticated access. The vulnerability is documented in SAP Security Note 2442993. According to the NVD entry, the affected component is the SAP Hostcontrol SOAP interface, with...