CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-29111 – Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)
https://notcve.org/view.php?id=CVE-2023-29111
The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application. • https://launchpad.support.sap.com/#/notes/3117978 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2023-29110 – Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
https://notcve.org/view.php?id=CVE-2023-29110
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application. • https://launchpad.support.sap.com/#/notes/3113349 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-29109 – Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
https://notcve.org/view.php?id=CVE-2023-29109
The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application. • https://launchpad.support.sap.com/#/notes/3115598 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-29108 – IP filter vulnerability in ABAP Platform and SAP Web Dispatcher
https://notcve.org/view.php?id=CVE-2023-29108
The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources. • https://launchpad.support.sap.com/#/notes/3315312 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-923: Improper Restriction of Communication Channel to Intended Endpoints •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28765 – Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
https://notcve.org/view.php?id=CVE-2023-28765
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application. • https://launchpad.support.sap.com/#/notes/3298961 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •