CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-37175 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-37175
09 Jul 2024 — SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information. SAP CRM WebClient no realiza la verificación de autorización necesaria para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto podría permitir que un atacante acceda a información confidencial. SAP CRM WebClient does not perform necessary authorization check for an authenticated user, res... • https://me.sap.com/notes/3467377 • CWE-862: Missing Authorization •
CVSS: 7.7EPSS: 0%CPEs: 7EXPL: 0CVE-2024-39598 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-39598
09 Jul 2024 — SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application. SAP CRM (WebClient UI Framework) permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con éxito, esto puede... • https://me.sap.com/notes/3467377 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 0CVE-2024-37174 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-37174
09 Jul 2024 — Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. La opción de soporte CSS personalizado en la interfaz de usuario de SAP CRM WebClient no codifica suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross Site Scripting. Si se explota con éxito, un ata... • https://me.sap.com/notes/3467377 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 0CVE-2024-37173 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-37173
09 Jul 2024 — Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. Debido a una validación de entrada insuficiente, la interfaz de usuario de SAP CRM WebClient permite que un atacante no autenticado cree un enlace URL que inco... • https://me.sap.com/notes/3467377 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 14EXPL: 0CVE-2024-34686 – Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-34686
11 Jun 2024 — Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. Debido a una validación de entrada insuficiente, la interfaz de usuario de SAP CRM WebClient permite que un atacante no autenticado cree un enlace URL que inco... • https://me.sap.com/notes/3465129 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.1EPSS: 0%CPEs: 7EXPL: 0CVE-2024-24742 – Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-24742
13 Feb 2024 — SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to integrity of the application data after successful exploitation. There is no impact on confidentiality and availability. UI de SAP CRM WebClient: versión S4FND 102, S4... • https://me.sap.com/notes/3158455 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 9EXPL: 0CVE-2024-22130 – Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
https://notcve.org/view.php?id=CVE-2024-22130
13 Feb 2024 — Print preview option in SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. An attacker with low privileges can cause limited impact to confidentiality and integrity of the appliaction data after successful exploitation. Opción de vista... • https://me.sap.com/notes/3410875 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •