Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,431 results · page 32 of 49

Feb 12, 2020Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system liCVE-2020-6190 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.8
Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure.
Product
SAP NetWeaver AS Java (Heap Dump Application)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-neCVE-2020-6189 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure.
Product
SAP Business Objects Business Intelligence Platform (CMC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 10CVE-2020-6188 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check.
Product
SAP ERP (SAP_APPL)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised adCVE-2020-6187 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.9
SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service.
Product
SAP NetWeaver (Guided Procedures)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leaCVE-2020-6186 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service.
Product
SAP Host Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), alloCVE-2020-6185 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability.
Product
SAP NetWeaver (SAP Basis)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), doeCVE-2020-6184 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
Product
Automated Note Search Tool (SAP Basis)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL procesCVE-2020-6183 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability.
Product
SAP Host Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, CVE-2020-6181 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.8
Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability.
Product
SAP NetWeaver (SAP Basis)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 12, 2020SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of serviceCVE-2020-6177 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server.
Product
SAP Mobile Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Feb 5, 2020SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function.CVE-2011-1517 · Network & remote access · SAP · reported by MITRECritical 9.8
SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash.
Product
Netweaver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com securityfocus.com
Jan 23, 2020A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when seCVE-2013-1593 · Network & remote access · SAP · reported by MITREHigh 7.5
A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP Message Server packet to TCP ports 36NN and/or 39NN.
Product
Netweaver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 23, 2020A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets CVE-2013-1592 · Network & remote access · SAP · reported by MITRECritical 9.8
A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code.
Product
Netweaver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coresecurity.com exploit-db.com
Jan 21, 2020WhatsApp Cross-Site Scripting VulnerabilityCVE-2019-18426 · Other software · Meta Platforms · reported by cve-assign@fb.comExploitedHigh 8.2
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Product
WhatsApp
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Meta Platforms’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com facebook.com
Jan 14, 2020Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depenCVE-2020-7057 · Network & remote access · Hikvision · reported by MITREMedium 5.3
Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are allowed.
Product
Ds-7204hghi-f1 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sku11army.blogspot.com sku11army.blogspot.com
Jan 14, 2020Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization cCVE-2020-6307 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information.
Product
Automated Note Search Tool (SAP Basis)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Jan 14, 2020Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17).CVE-2020-6306 · Network & remote access · SAP SE · reported by cna@sap.comLow 2.7
Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17).
Product
SAP Leasing (SAP_Appl)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Jan 14, 2020PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in CrosCVE-2020-6305 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Product
SAP Process Integration - Rest Adapter (SAP_XIAF)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Jan 14, 2020Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNLCVE-2020-6304 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.
Product
SAP NetWeaver Internet Communication Manager (KRNL32NUC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Jan 14, 2020SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.CVE-2020-6303 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.
Product
SAP Disclosure Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 17, 2019Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6CVE-2019-0384 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
Product
SAP Treasury and Risk Management (S4CORE)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 17, 2019Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6CVE-2019-0383 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Product
SAP Treasury and Risk Management (S4CORE)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a useCVE-2019-0405 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a user enumeration vulnerability and Information Disclosure.
Product
SAP Enable Now
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure.CVE-2019-0404 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure.
Product
SAP Enable Now
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command InjectiCVE-2019-0403 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.8
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection.
Product
SAP Enable Now
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information CVE-2019-0402 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.4
SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information Disclosure.
Product
SAP Adaptive Server Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discoverCVE-2019-0399 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discover accounting information of the Projects in Project dashboard, leading to Information Disclosure.
Product
SAP Portfolio and Project Management (S4CORE)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to CVE-2019-0398 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to an authenticated user to send unintended request to the web server, leading to Cross Site Request Forgery.
Product
SAP BusinessObjects Business Intelligence Platform (Monitoring Application)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 11, 2019SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI LaunchpCVE-2019-0395 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launchpad, leading to Stored Cross Site Scripting vulnerability.
Product
SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 14, 2019A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user.CVE-2019-11931 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.8
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record facebook.com facebook.com
Nov 13, 2019SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML dCVE-2019-0396 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.1
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficiently validate an XML document accepted from an untrusted source. An attacker can craft a message that contains malicious elements that will not be correctly filtered by Web Intelligence HTML interface in some specific workflows.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insufCVE-2019-0388 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insufficient URL validation.
Product
SAP UI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1CVE-2019-0386 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.3
Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges.
Product
SAP ERP Sales (SAP_APPL)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database CVE-2019-0393 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields of historical inspection results.
Product
SAP Quality Management (S4CORE)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise CVE-2019-0391 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
Product
SAP NetWeaver AS Java
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted.CVE-2019-0390 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted. Connection details that are maintained in Connection Manager are visible to users.
Product
SAP Data Hub (DH_Foundation)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for allCVE-2019-0389 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for all or some functions in Java Server, and enable users to execute functions, they are not allowed to execute otherwise.
Product
SAP NetWeaver Application Server Java (J2EE-Framework)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2019-0385 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Product
SAP Enable Now
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 13, 2019A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in verCVE-2019-0382 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related pages); corrected in version 4.2. Privileges are required in order to exploit this vulnerability.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Nov 4, 2019SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instaCVE-2019-0350 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA instance, leading to Denial of Service
Product
SAP HANA Database
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 23, 2019A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remote attackers to exeCVE-2019-11933 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remote attackers to execute arbitrary code or cause a denial of service.
Product
WhatsApp for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record facebook.com facebook.com
Oct 8, 2019A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inCVE-2019-0381 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user.
Product
SAP IQ
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the appCVE-2019-0380 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.9
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure.
Product
SAP Landscape Management enterprise edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is chCVE-2019-0379 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle (BC), leading to Missing Authentication Check
Product
SAP Process Integration, business-to-business add-on
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs anCVE-2019-0378 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs aCVE-2019-0377 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled CVE-2019-0376 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled CVE-2019-0375 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled CVE-2019-0374 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting
Product
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 8, 2019Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the struCVE-2019-0370 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.
Product
SAP Financial Consolidation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.