CVSS: 10.0EPSS: 17%CPEs: 2EXPL: 0CVE-2024-41730 – Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
https://notcve.org/view.php?id=CVE-2024-41730
13 Aug 2024 — In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability. In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully comprom... • https://me.sap.com/notes/3479478 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34692 – [CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now
https://notcve.org/view.php?id=CVE-2024-34692
09 Jul 2024 — Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker can cause limited impact on confidentiality and Integrity of the application. Debido a la falta de verificación del tipo o contenido del archivo, SAP Enable Now permite que un atacante autenticado cargue archivos arbitrarios. Estos arch... • https://me.sap.com/notes/3476340 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2024-37171 – [CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal)
https://notcve.org/view.php?id=CVE-2024-37171
09 Jul 2024 — SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unintended service, which may reveal information about that service. The information obtained could be used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerabil... • https://me.sap.com/notes/3469958 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-34689 – [CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)
https://notcve.org/view.php?id=CVE-2024-34689
09 Jul 2024 — WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application. WebFlow Services de SAP Business Workflow permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con... • https://me.sap.com/notes/3458789 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37172 – [CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)
https://notcve.org/view.php?id=CVE-2024-37172
09 Jul 2024 — SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality and availability but there is no impact on the integrity. SAP S/4HANA Finance (Advanced Payment Management) no realiza la verificación de autorización necesaria para un usuario autenticado, lo que resulta en una escalada de privilegios. Como resultado, tiene un bajo impacto en la confidencialidad... • https://me.sap.com/notes/3457354 • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-37175 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-37175
09 Jul 2024 — SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information. SAP CRM WebClient no realiza la verificación de autorización necesaria para un usuario autenticado, lo que resulta en una escalada de privilegios. Esto podría permitir que un atacante acceda a información confidencial. SAP CRM WebClient does not perform necessary authorization check for an authenticated user, res... • https://me.sap.com/notes/3467377 • CWE-862: Missing Authorization •
CVSS: 7.7EPSS: 0%CPEs: 7EXPL: 0CVE-2024-39598 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-39598
09 Jul 2024 — SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application. SAP CRM (WebClient UI Framework) permite a un atacante autenticado enumerar endpoints HTTP accesibles en la red interna mediante la elaboración especial de solicitudes HTTP. Si se explota con éxito, esto puede... • https://me.sap.com/notes/3467377 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 0CVE-2024-37174 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-37174
09 Jul 2024 — Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. La opción de soporte CSS personalizado en la interfaz de usuario de SAP CRM WebClient no codifica suficientemente las entradas controladas por el usuario, lo que genera una vulnerabilidad de Cross Site Scripting. Si se explota con éxito, un ata... • https://me.sap.com/notes/3467377 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 0CVE-2024-37173 – [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
https://notcve.org/view.php?id=CVE-2024-37173
09 Jul 2024 — Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. Debido a una validación de entrada insuficiente, la interfaz de usuario de SAP CRM WebClient permite que un atacante no autenticado cree un enlace URL que inco... • https://me.sap.com/notes/3467377 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34685 – [CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor
https://notcve.org/view.php?id=CVE-2024-34685
09 Jul 2024 — Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application but it has a low impact on its confidentiality and integrity. Debido a la codificación débil de la entrada controlada por el usuario en SAP NetWeaver Knowledge Management XMLEditor, que permite que se puedan ejecutar scripts m... • https://me.sap.com/notes/3468681 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •