CVSS: 9.7EPSS: 0%CPEs: 20EXPL: 0CVE-2023-35871 – Memory Corruption vulnerability in SAP Web Dispatcher
https://notcve.org/view.php?id=CVE-2023-35871
11 Jul 2023 — The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosur... • https://me.sap.com/notes/3340735 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-35870 – Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)
https://notcve.org/view.php?id=CVE-2023-35870
11 Jul 2023 — When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable. • https://me.sap.com/notes/3341211 • CWE-284: Improper Access Control CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-33992 – Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA
https://notcve.org/view.php?id=CVE-2023-33992
11 Jul 2023 — The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to exploit this, the user still needs authorizations on the query as well as on the keyfigure/measure level. The missing check only affects the data level. • https://me.sap.com/notes/3088078 • CWE-862: Missing Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33990 – Denial of Service (DoS) vulnerability in SAP SQL Anywhere
https://notcve.org/view.php?id=CVE-2023-33990
11 Jul 2023 — SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be leveraged by an attacker to perform a Denial of Service. Further, an attacker might be able to modify sensitive data in shared memory objects.This issue only affects SAP SQL Anywhere on Windows. Other platforms are not impacted. • https://me.sap.com/notes/3331029 • CWE-277: Insecure Inherited Permissions CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.7EPSS: 0%CPEs: 4EXPL: 0CVE-2023-33989 – Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
https://notcve.org/view.php?id=CVE-2023-33989
11 Jul 2023 — An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system compromise. • https://me.sap.com/notes/3331376 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33988 – Cross-Site Scripting vulnerability in SAP Enable Now
https://notcve.org/view.php?id=CVE-2023-33988
11 Jul 2023 — In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in disclosure or modification of information. • https://me.sap.com/notes/3326769 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.7EPSS: 0%CPEs: 24EXPL: 0CVE-2023-33987 – Request smuggling and request concatenation in SAP Web Dispatcher
https://notcve.org/view.php?id=CVE-2023-33987
11 Jul 2023 — An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over severa... • https://me.sap.com/notes/3233899 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31405 – Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
https://notcve.org/view.php?id=CVE-2023-31405
11 Jul 2023 — SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability. • https://me.sap.com/notes/3324732 • CWE-117: Improper Output Neutralization for Logs •
CVSS: 8.2EPSS: 0%CPEs: 6EXPL: 0CVE-2023-33991 – Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management
https://notcve.org/view.php?id=CVE-2023-33991
13 Jun 2023 — SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerability. After successful exploitation, an attacker with user level access can cause high impact on confidentiality, modify some information and can cause unavailability of the application at user level. • https://launchpad.support.sap.com/#/notes/3324285 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33986 – Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)
https://notcve.org/view.php?id=CVE-2023-33986
13 Jun 2023 — SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application. • https://launchpad.support.sap.com/#/notes/2826092 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •