Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

2,431 results · page 13 of 49

Jun 13, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-4149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.2.3
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 11, 2024Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution VulnerabilityCVE-2024-30097 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jun 10, 2024SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting imCVE-2024-37176 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application.
Product
SAP BW/4HANA Transformation and Data Transfer Process
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of priviCVE-2024-34691 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system.
Product
SAP S/4HANA (Manage Incoming Payment Files)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilegesCVE-2024-34690 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application.
Product
SAP Student Life Cycle Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may preveCVE-2024-34688 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availability of the application.
Product
SAP NetWeaver AS Java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script.CVE-2024-34686 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application.
Product
SAP CRM WebClient UI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to accesCVE-2024-34684 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.7
On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read or modify the remote server files.
Product
SAP BusinessObjects Business Intelligence Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024An authenticated attacker can upload malicious file to SAP Document Builder service.CVE-2024-34683 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.
Product
SAP Document Builder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service.CVE-2024-33001 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application.
Product
SAP NetWeaver and ABAP platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be resCVE-2024-28164 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.
Product
SAP NetWeaver AS Java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2024-37178 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application.
Product
SAP Financial Consolidation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024SAP Financial Consolidation allows data to enter a Web application through an untrusted source.CVE-2024-37177 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application.
Product
SAP Financial Consolidation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 22, 2024idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close.CVE-2024-35557 · Other software · idccms_project · reported by MITREMedium 5.5
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close.
Product
idccms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 14, 2024SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain sensitive informationCVE-2024-33485 · Other software · casap_automated_enrollment_system_project · reported by MITRECritical 9.8
SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the login.php component
Product
casap_automated_enrollment_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
May 14, 2024Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-4139 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
Product
SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-4138 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
Product
SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabiCVE-2024-34687 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session. Hence, this could have impact on Confidentiality, Integrity and Availability of the system.
Product
SAP NetWeaver Application server for ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024SAP Global Label Management is vulnerable to SQL injection.CVE-2024-33009 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.2
SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could lead to low impact on Confidentiality and Integrity of the application.
Product
SAP Global Label Management (GLM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD.CVE-2024-33008 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.9
SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with high impact on Availability of the system.
Product
SAP Replication Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default.CVE-2024-33007 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.
Product
SAPUI5 (PDFViewer)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024 An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.CVE-2024-33006 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
Product
SAP NetWeaver Application Server ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out.CVE-2024-33004 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application.
Product
SAP BusinessObjects Business Intelligence Platform (Webservices)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vuCVE-2024-33002 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application.
Product
SAP S/4HANA (Document Service Handler for DPS)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges.CVE-2024-33000 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system.
Product
SAP Bank Account Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024 Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attackCVE-2024-32733 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify sensitive information with no impact on availability of the application
Product
SAP NetWeaver Application Server ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024 SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-32731 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality, integrity and availability of the application.
Product
SAP My Travel Requests
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024 SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which coCVE-2024-28165 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application
Product
SAP BusinessObjects Business Intelligence Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-32730 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the confidentiality of the application.
Product
SAP Enable Now
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.1.9
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2024Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0.CVE-2022-47894 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. For more information, the fix already was merged in the source code but Zeppelin decided to retire the SAP component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Product
Apache Zeppelin SAP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Apr 8, 2024The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashinCVE-2024-30218 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability.
Product
SAP NetWeaver AS ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-30217 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can approve or reject a bank account application affecting the integrity of the application. Confidentiality and Availability are not impacted.
Product
SAP S/4 HANA (Cash Management)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-30216 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, attacker can add notes in the review request with 'completed' status affecting the integrity of the application. Confidentiality and Availability are not impacted.
Product
SAP S/4 HANA (Cash Management)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page.CVE-2024-30215 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a successful attack, some information could be obtained and/or modified. However, the attacker does not have control over what information is obtained, or the amount or kind of loss is limited.
Product
SAP Business Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response.CVE-2024-30214 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.8
The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed on client side.
Product
SAP Business Connector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-28167 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
Product
SAP Group Reporting Data Collection (Enter Package Data)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to CVE-2024-27901 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.2
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.
Product
SAP Asset Accounting
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of thCVE-2024-27899 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.
Product
SAP NetWeaver AS Java User Management Engine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internCVE-2024-27898 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.
Product
SAP NetWeaver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 8, 2024Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crCVE-2024-25646 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.
Product
SAP BusinessObjects Web Intelligence
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Apr 3, 2024Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csapp,lab3/buflab-updaCVE-2024-28515 · Other software · cornerstoneplatform · reported by MITRECritical 9.8
Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csapp,lab3/buflab-update.pl component.
Product
csapp_lab3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Mar 11, 2024Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otheCVE-2024-28163 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.
Product
SAP NetWeaver Process Integration (Support Web Pages)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Mar 11, 2024Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-SitCVE-2024-27902 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
Product
SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Mar 11, 2024Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templatesCVE-2024-27900 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner.
Product
SAP ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Mar 11, 2024Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing loCVE-2024-25645 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application.
Product
SAP NetWeaver (Enterprise Portal)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Mar 11, 2024Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on CVE-2024-25644 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.
Product
NetWeaver (WSRM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Mar 11, 2024SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information.CVE-2024-22133 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.6
SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the application.
Product
SAP Fiori Front End Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Mar 11, 2024SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous fCVE-2024-22127 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.
Product
SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Feb 28, 2024Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.CVE-2024-26461 · Other software · mit · reported by MITREHigh 7.5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
Product
kerberos_5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security.netapp.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.