CVE-2021-21480

SAP MII’s Self Service Composition Environment (SSCE) lets dashboards be saved as JSP files. CVE-2021-21480 is a code-injection/remote code execution vulnerability where an attacker can intercept a dashboard request, inject JSP, and have it executed when opened by a user with SAP_XMII Developer p...

CVE-2015-8329

SAP Manufacturing Integration and Intelligence (MII) is affected by an encryption downgrade vulnerability due to the use of Base64 and DES. The issue allows downgrade attacks and potential password decryption. Reported impact references are tied to SAP MII versions 12.2, 14.0 and 15.0 (and possib...

CVE-2019-0267

CVE-2019-0267 affects SAP Manufacturing Integration and Intelligence (MII), specifically versions 15.0, 15.1 and 15.2, where the Illuminator Servlet does not provide Anti-XSRF tokens. Root cause: lack of anti-forgery protections in the Illuminator Servlet, which can enable Cross-Site Request Forg...