CVSS: 9.4EPSS: 0%CPEs: 15EXPL: 0CVE-2023-32113 – Information Disclosure vulnerability in SAP GUI for Windows
https://notcve.org/view.php?id=CVE-2023-32113
09 May 2023 — SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify potentially sensitive information after successful exploitation. • https://launchpad.support.sap.com/#/notes/3320467 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41205
https://notcve.org/view.php?id=CVE-2022-41205
08 Nov 2022 — SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application. SAP GUI permite a un atacante autenticado ejecutar scripts en la red local. Si la explotación tiene éxito, el atacante puede obtener acceso a los registros, lo que puede causar un impacto limitado en la confidencialidad y un alto impacto en la disponibili... • https://launchpad.support.sap.com/#/notes/3237251 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 19EXPL: 0CVE-2021-40503
https://notcve.org/view.php?id=CVE-2021-40503
10 Nov 2021 — An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user. Se presenta una vulnerabilidad de divulgación de información en SAP G... • https://launchpad.support.sap.com/#/notes/3080106 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 0CVE-2021-27612
https://notcve.org/view.php?id=CVE-2021-27612
11 May 2021 — In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim. En situaciones específicas, SAP GUI para Windows hasta e incluyendo las versiones 7.60 PL9, 7.70 PL0, reenvía a un usuario a un sitio web malicioso específico que podría contener malware o podría conllevar a ataques de phishing para robar las credenciales de la víctima • https://launchpad.support.sap.com/#/notes/3023078 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •