Filtered by vendor Sap Se Subscriptions
Total 9 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-39592 2 Sap, Sap Se 3 S4core, S4coreop, Sap Pdce 2024-11-21 7.7 High
Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.
CVE-2024-33007 1 Sap Se 1 Sapui5 2024-11-21 3.5 Low
PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.
CVE-2024-33004 1 Sap Se 1 Sap Business Objects Business Intgelligence Platform 2024-11-21 4.3 Medium
SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache and can open the pages causing limited impact on Confidentiality, Integrity and Availability of the application.
CVE-2024-28167 1 Sap Se 1 Sap Group Reporting Data Collection 2024-11-21 6.5 Medium
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.
CVE-2024-45277 2 Sap, Sap Se 2 Hana-client, Sap Hana Client 2024-11-14 4.3 Medium
The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanitation when using the nestTables feature causing low impact on the availability of the application. This has no impact on Confidentiality and Integrity.
CVE-2024-45278 2 Sap, Sap Se 2 Commerce Backoffice, Sap Commerce Backoffice 2024-11-14 5.4 Medium
SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.
CVE-2024-47593 1 Sap Se 1 Sap Netweaver And Abap Platform 2024-11-12 4.3 Medium
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.
CVE-2024-42374 2 Sap, Sap Se 2 Bex Web Java Runtime Export Web Service, Bex Web Java Runtime Export Web Service 2024-09-16 8.2 High
BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.
CVE-2024-41730 2 Sap, Sap Se 2 Business Objects Business Intelligence Platform, Sap Business Objects Business Intgelligence Platform 2024-09-12 9.8 Critical
In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.