Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,431 results · page 11 of 49
Jan 13, 2025Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability.CVE-2025-0059 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view senCVE-2025-0058 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
- Product
- SAP Business Workflow and SAP Flexible Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability.CVE-2025-0057 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.
- Product
- SAP NetWeaver AS JAVA (User Admin Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP GUI for Java saves user input on the client PC to improve usability.CVE-2025-0056 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
- Product
- SAP GUI for Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP GUI for Windows stores user input on the client PC to improve usability.CVE-2025-0055 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
- Product
- SAP GUI for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information.CVE-2025-0053 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025WhatsApp 🚀 click to chat: Reflected Cross-Site ScriptingCVE-2024-11686 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WhatsApp 🚀 click to chat
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update WhatsApp 🚀 click to chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 9, 2024In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinCVE-2024-54198 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.5
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially craftiCVE-2024-54197 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.2
SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in Server-Side Request Forgery (SSRF) which could have a low impact on integrity and confidentiality of data. It has no impact on availability of the application.
- Product
- SAP NetWeaver Administrator(System Overview)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting imCVE-2024-47585 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied for both, which may contribute to these risks. On successful exploitation, this can result in potential security concerns. However, it has no impact on the integrity and availability of the application and may have only a low impact on data confidentiality.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack.CVE-2024-47582 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.
- Product
- SAP NetWeaver AS JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privilegeCVE-2024-47581 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted.
- Product
- SAP HCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment.CVE-2024-47580 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server.CVE-2024-47579 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any file on the server with no effect on integrity or availability
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application.CVE-2024-47578 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. On successful exploitation, the attacker can read or modify any file and/or make the entire system unavailable.
- Product
- SAP NetWeaver AS for JAVA (Adobe Document Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability.CVE-2024-47577 · Websites & servers · SAP_SE · reported by cna@sap.comLow 2.7
Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability. When an authorized agent searches for customer to manage their accounts, the request url includes customer data and it is recorded in server logs. If an attacker impersonating as authorized admin visits such server logs, then they get access to the customer data. The amount of leaked confidential data however is extremely limited, and the attacker has no control over what data is leaked.
- Product
- SAP Commerce Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS.CVE-2024-47576 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.3
SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the computer running SAP Product Lifecycle Costing Client application. That particular DLL could be replaced by a malicious one, that could execute commands as being part of SAP Product Lifecycle Costing Client Application. On a successful attack, it can cause a low impact to confidentiality but no impact to the integrity and availability of the application.
- Product
- SAP Product Lifecycle Costing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This haCVE-2024-32732 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Confidentiality with no impact on Integrity and Availability of the application.
- Product
- SAP BusinessObjects Business Intelligence platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code.CVE-2024-49415 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 8.1
Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Nov 11, 2024An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access.CVE-2024-47595 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high impact on confidentiality and integrity of the application.
- Product
- SAP Host Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.CVE-2024-47593 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs.CVE-2024-47592 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.
- Product
- SAP NetWeaver Application Server Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024An unauthenticated attacker can create a malicious link which they can make publicly available.CVE-2024-47590 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.
- Product
- SAP Web Dispatcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext toCVE-2024-47588 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.
- Product
- SAP NetWeaver Java (Software Update Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiCVE-2024-47587 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application.
- Product
- SAP Cash Management (Cash Operations)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a nuCVE-2024-47586 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD conCVE-2024-42372 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver AS Java (System Landscape Directory)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.CVE-2024-34678 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Oct 8, 2024Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution VulnerabilityCVE-2024-43574 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catcCVE-2024-9026 · Websites & servers · PHP Group · reported by security@php.netLow 3.3
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 8, 2024SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet.CVE-2024-47594 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim who is registered on the portal clicks on such link, confidentiality and integrity of their web browser session could be compromised.
- Product
- SAP NetWeaver Enterprise Portal (KMC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method.CVE-2024-45282 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against external modifications leading to integrity violations. Confidentiality and Availability are not impacted.
- Product
- SAP S/4 HANA (Manage Bank Statements)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2024-45278 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
- Product
- SAP Commerce Backoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary prCVE-2024-45277 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.
- Product
- SAP HANA Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to CVE-2024-37179 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on confidentiality of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the JenCVE-2024-47804 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to persist it, effectively bypassing the item creation restriction.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi.CVE-2024-46566 · Network & remote access · Draytek · reported by MITREHigh 7.5
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- Product
- Vigor3910 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordink-desk-28f.notion.site
Sep 12, 2024whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework.CVE-2024-45607 · Other software · Secreto31126 · reported by GitHubMedium 5.8
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.
- Product
- whatsapp-api-js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes.CVE-2024-45285 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted.CVE-2024-45284 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.4
An authenticated attacker with high privilege can use functions of SLCM transactions to which access should be restricted. This may result in an escalation of privileges causing low impact on integrity of the application.
- Product
- SAP Student Life Cycle Management (SLcM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information.CVE-2024-45283 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but cannot modify or delete the data.
- Product
- SAP NetWeaver AS for Java (Destination Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally siCVE-2024-45281 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.8
SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This could result in a high impact on confidentiality and integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application.CVE-2024-45280 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.
- Product
- SAP NetWeaver AS Java (Logon Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker toCVE-2024-45279 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthenticated attacker to craft a URL link which could embed a malicious JavaScript. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted.CVE-2024-44121 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of the application
- Product
- SAP S/4 HANA (Statutory Reports)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input.CVE-2024-44120 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the attacker could read and manipulate user content in the browser.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ICVE-2024-44117 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID. There is low impact on integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauCVE-2024-45286 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
Due to lack of proper authorization checks when calling user, a function module in obsolete Tobin interface in SAP Production and Revenue Accounting allows unauthorized access that could lead to disclosure of highly sensitive data. There is no impact on integrity or availability.
- Product
- SAP Production and Revenue Accounting (Tobin interface)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a rCVE-2024-44112 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a remote-enabled function which will allow them to delete non-sensitive entries in a user data table. There is no effect on confidentiality or availability.
- Product
- SAP for Oil & Gas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contCVE-2024-41728 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.7
Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.