CVE-2021-33701

CVE-2021-33701 affects SAP NetWeaver/DMIS components (e.g., SAP DMIS 2011_1_731 SP0013) via a remote SQL injection in the NDZT tool used by S/4HANA and the DMIS mobile plug-in. The root cause is an injection in the IUUC_RECON_RC_COUNT_TABLE_BIG/related query surface, enabling an attacker with hig...

CVE-2022-31597

CVE-2022-31597 affects SAP S/4HANA: S4CORE versions 101–106 and SAPSCORE 127, specifically the application business partner extension for Spain/Slovakia. Root cause: the extension does not perform necessary authorization checks for a low-privileged authenticated user over the network, enabling pr...

CVE-2018-2419

CVE-2018-2419 concerns SAP Enterprise Financial Services (SAPSCORE 1.11/1.12; S4CORE 1.01/1.02; EA-FINSERV 6.x, 8.0) where an authenticated user can escalate privileges due to missing authorization checks. The description and related sources corroborate a privilege-escalation flaw without detaili...

CVE-2023-29188

The CVE-2023-29188 issue affects SAP CRM WebClient UI and related components: SAPSCORE 129, S4FND 102–107, WEBCUIF 701–801. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient encoding of user-controlled inputs. Successful exploitation could allow a user with normal acce...

CVE-2019-0244

CVE-2019-0244 affects SAP CRM WebClient UI components (SAPSCORE, S4FND, WEBCUIF). The vulnerability arises from insufficient encoding of user-controlled inputs, enabling Cross-Site Scripting (XSS). Affected product areas: SAP CRM WebClient UI; fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.4...

CVE-2019-0245

SAP CRM WebClient UI is affected by a Cross-Site Scripting (XSS) vulnerability due to insufficient encoding of user-controlled inputs. The flaw affects SAPSCORE 1.12; S4FND 1.02; WEBCUIF components 7.31, 7.46, 7.47, 7.48, 8.0, and 8.01. The root cause is improper input encoding in the web client ...

CVE-2018-2484

CVE-2018-2484 (SAP Enterprise Financial Services) is a privilege-escalation vulnerability caused by a failure to perform necessary authorization checks for an authenticated user. The affected stack includes SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15), S4CORE (1.01–1.03)...