CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28167 – Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)
https://notcve.org/view.php?id=CVE-2024-28167
09 Apr 2024 — SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction. SAP Group Reporting Data Collection no realiza las verificaciones de autorización necesarias para un usuario autenticado, lo que resulta en una escalada de privilegi... • https://me.sap.com/notes/3442378 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27899 – Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
https://notcve.org/view.php?id=CVE-2024-27899
09 Apr 2024 — Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability. Self-Registration and Modify your own profile en User Admin Application de NetWeaver AS Java no exige requisitos de seguridad adecuados para el contenido de la respuesta de seguridad reci... • https://me.sap.com/notes/3434839 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27898 – Server-Side Request Forgery in SAP NetWeaver
https://notcve.org/view.php?id=CVE-2024-27898
09 Apr 2024 — SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality. La aplicación SAP NetWeaver, debido a una validación de entrada insuficiente, permite a un atacante enviar una solicitud manipulada desde una aplic... • https://me.sap.com/notes/3425188 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-25646 – Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence
https://notcve.org/view.php?id=CVE-2024-25646
09 Apr 2024 — Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application. Debido a una validación incorrecta, SAP BusinessObject Business Intelligence Launch Pad permite que un atacante autenticado acceda a información del sistema operativo mediante un documento manipulado. Una explotación exitosa podría t... • https://me.sap.com/notes/3421384 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25645 – Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)
https://notcve.org/view.php?id=CVE-2024-25645
12 Mar 2024 — Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application. Bajo ciertas condiciones, SAP NetWeaver (Enterprise Portal): la versión 7.50 permite a un atacante acceder a información que de otro modo estaría restringida, lo que causa un impacto bajo en la confidencialidad de la aplicación y sin im... • https://me.sap.com/notes/3428847 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28163 – Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)
https://notcve.org/view.php?id=CVE-2024-28163
12 Mar 2024 — Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application. Bajo ciertas condiciones, las páginas web de soporte de SAP NetWeaver Process Integration (PI), versiones 7.50, permiten a un atacante acceder a información que de otro modo estaría restringida, lo que causa un bajo impacto en l... • https://me.sap.com/notes/3434192 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27902 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)
https://notcve.org/view.php?id=CVE-2024-27902
12 Mar 2024 — Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system Las aplicaciones basadas en SAP GUI para HTML en SAP NetWeaver AS ABAP (versiones 7.89, 7.93) no codifican suficientemente las ent... • https://me.sap.com/notes/3377979 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2024-27900 – Missing Authorization check in SAP ABAP Platform
https://notcve.org/view.php?id=CVE-2024-27900
12 Mar 2024 — Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner. Debido a la falta de verificación de autorización, un atacante con cuenta de usuario empresarial en SAP ABAP Platform (versión 758, 795) puede cambiar la configuración de privacidad de las plantillas de trabajo de compartida a privada. Como resultado, s... • https://me.sap.com/notes/3419022 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25644 – Information Disclosure vulnerability in NetWeaver (WSRM)
https://notcve.org/view.php?id=CVE-2024-25644
12 Mar 2024 — Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application. Bajo ciertas condiciones, SAP NetWeaver WSRM - versión 7.50, permite que un atacante acceda a información que de otro modo estaría restringida, lo que causa un bajo impacto en la confidencialidad sin ningún impacto en la integridad y disponibilidad de la aplicación. Unde... • https://me.sap.com/notes/3425682 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22133 – Improper Access Control in SAP Fiori Front End Server
https://notcve.org/view.php?id=CVE-2024-22133
12 Mar 2024 — SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the application. SAP Fiori Front End Server: versión 605, permite modificar los detalles del aprobador en el campo de solo lectura al enviar información de solicitud de licencia. Esto podría dar lugar a la creación de una ... • https://me.sap.com/notes/3417399 • CWE-863: Incorrect Authorization •