CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2024-34686 – Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-34686
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. Debido a una validación de entrada insuficiente, la interfaz de usuario de SAP CRM WebClient permite que un atacante no autenticado cree un enlace URL que incorpore un script malicioso. Cuando una víctima hace clic en este enlace, el script se ejecutará en el navegador de la víctima, dándole al atacante la capacidad de acceder y/o modificar información sin ningún efecto sobre la disponibilidad de la aplicación. • https://me.sap.com/notes/3465129 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2024-34683 – Unrestricted file upload in SAP Document Builder (HTTP service)
https://notcve.org/view.php?id=CVE-2024-34683
An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser. Un atacante autenticado puede cargar un archivo malicioso en el servicio SAP Document Builder. Cuando la víctima accede a este archivo, el atacante puede acceder, modificar o hacer que la información relacionada no esté disponible en el navegador de la víctima. • https://me.sap.com/notes/3459379 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33001 – Denial of service (DOS) in SAP NetWeaver and ABAP platform
https://notcve.org/view.php?id=CVE-2024-33001
SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application. La plataforma SAP NetWeaver y ABAP permite a un atacante impedir el rendimiento de usuarios legítimos bloqueando o inundando el servicio. Un impacto de esta vulnerabilidad de denegación de servicio podría ser largas demoras en la respuesta e interrupciones del servicio, degradando así la calidad del servicio experimentada por los usuarios legítimos y causando un alto impacto en la disponibilidad de la aplicación. • https://me.sap.com/notes/3453170 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37178 – Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
https://notcve.org/view.php?id=CVE-2024-37178
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application. SAP Financial Consolidation no codifica suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross-Site Scripting (XSS). • https://me.sap.com/notes/3457592 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37177 – Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
https://notcve.org/view.php?id=CVE-2024-37177
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application. SAP Financial Consolidation permite que los datos ingresen a una aplicación web a través de una fuente que no es de confianza. Estos endpoints están expuestos a través de la red y permiten al usuario modificar el contenido del sitio web. • https://me.sap.com/notes/3457592 https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •