CVE-2022-39802

SAP Manufacturing Execution (versions 15.1–15.3) is affected by a path-traversal vulnerability due to insufficient validation of a file path request parameter. An attacker can manipulate the file path to traverse directories remotely and read file contents, leading to information disclosure. The ...

CVE-2021-27615

SAP Manufacturing Execution versions 15.1, 1.5.2, 15.3, and 15.4 are affected by a cross-site scripting vulnerability due to missing HTTP security headers in HTTP responses. The described root cause is the absence of these headers, which can enable an attacker to execute XSS. Exploitation status,...

CVE-2021-27600

SAP Manufacturing Execution (System Rules) versions 15.1–15.4 are affected by a Stored XSS vulnerability caused by insufficient encoding of certain HTTP parameters in the System Rules tab. An authorized attacker could embed malicious code into HTTP parameters and have it processed by the server, ...