We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.

×

Yikes, there is work to do!
This time we found critical correction advisiories. We count 163 and the highest CVSS score is 10.0.

 

Severity
SAP© Security advisories 163
 System Types
Affected SAP© system types

 

Related note
3399691
CVSS
9.1

Affected system type ABAP
Patchday 2023-12
Released on 2023/12/12
Description Update 1 to 3350297 - [CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Security Advisory
Related note
3411067
CVSS
9.1

Affected system type BTP
Patchday 2023-12
Released on 2023/12/12
Description [Multiple CVEs] Escalation of Privileges in SAP Business Technology Platform (BTP) Security Services Integration Libraries
Security Advisory
Related note
3394567
CVSS
8.1

Affected system type SAP Commerce
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-42481] Improper Access Control vulnerability in SAP Commerce Cloud
Security Advisory
Related note
3382353
CVSS
7.5

Affected system type BI/BO platform
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-42478] Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
Security Advisory
Related note
3385711
CVSS
7.3

Affected system type SAP GUI / Frontend
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49580] Information disclosure vulnerability in SAP GUI for WIndows and SAP GUI for Java
Security Advisory
Related note
3406244
CVSS
7.1

Affected system type Android SDK
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-6542] Missing Authorization Check in SAP EMARSYS SDK ANDROID
Security Advisory
Related note
3369353
CVSS
6.8

Affected system type BI/BO platform
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-42476] Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence
Security Advisory
Related note
3395306
CVSS
6.4

Affected system type ABAP
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49587] Command Injection vulnerability in SAP Solution Manager
Security Advisory
Related note
3383321
CVSS
6.1

Affected system type Java
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-42479] Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct
Security Advisory
Related note
3217087
CVSS
6.1

Affected system type ABAP
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49577] Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)
Security Advisory
Related note
3159329
CVSS
5.3

Affected system type ABAP
Patchday 2023-12
Released on 2023/12/12
Description Denial of service (DoS) vulnerability in JSZip library bundled within SAPUI5
Security Advisory
Related note
3406786
CVSS
4.3

Affected system type SAP UI5
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49584] Client-Side Desynchronization vulnerability in SAP Fiori Launchpad
Security Advisory
Related note
3392547
CVSS
4.1

Affected system type ABAP
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49581] SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Security Advisory
Related note
3363690
CVSS
3.5

Affected system type ABAP
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49058] Directory Traversal vulnerability in SAP Master Data Governance
Security Advisory
Related note
3362463
CVSS
3.5

Affected system type SAP Cloud Connector
Patchday 2023-12
Released on 2023/12/12
Description [CVE-2023-49578] Denial of service (DOS) in SAP Cloud Connector
Security Advisory
Related note
3355658
CVSS
9.6

Affected system type SAP Business One
Patchday 2023-11
Released on 2023/11/14
Description [CVE-2023-31403] Improper Access Control vulnerability in SAP Business One product installation
Security Advisory
Related note
3362849
CVSS
5.3

Affected system type Kernel
Patchday 2023-11
Released on 2023/11/14
Description [CVE-2023-41366] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Security Advisory
Related note
3366410
CVSS
5.3

Affected system type Java
Patchday 2023-11
Released on 2023/11/14
Description [CVE-2023-42480] Information Disclosure in NetWeaver AS Java Logon
Security Advisory
Related note
3372991
CVSS
6.8

Affected system type BI/BO platform
Patchday 2023-10
Released on 2023/10/10
Description [CVE-2023-42474] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence
Security Advisory
Related note
3333426
CVSS
6.5

Affected system type Java
Patchday 2023-10
Released on 2023/10/26
Description [CVE-2023-42477] Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)
Security Advisory
Related note
3357154
CVSS
6.5

Affected system type SAP PowerDesigner
Patchday 2023-10
Released on 2023/10/10
Description [CVE-2023-40310] Missing XML Validation vulnerability in SAP PowerDesigner Client (BPMN2 import)
Security Advisory
Related note
3371873
CVSS
5.3

Affected system type Java
Patchday 2023-10
Released on 2023/10/10
Description Update 1 to Security Note 3324732: [CVE-2023-31405] Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
Security Advisory
Related note
3338380
CVSS
4.3

Affected system type SAP Business One
Patchday 2023-10
Released on 2023/10/10
Description [CVE-2023-41365] Information Disclosure vulnerability in SAP Business One (B1i)
Security Advisory
Related note
3222121
CVSS
4.3

Affected system type ABAP
Patchday 2023-10
Released on 2023/10/10
Description [CVE-2023-42475] Information Disclosure Vulnerability in Statutory Reporting
Security Advisory
Related note
3320355
CVSS
9.9

Affected system type SAP BI
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40622] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Security Advisory
Related note
3340576
CVSS
9.8

Affected system type Kernel, HANA...
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40309] Missing Authorization check in SAP CommonCryptoLib
Security Advisory
Related note
3370490
CVSS
8.7

Affected system type BI/BO platform
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-42472] Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
Security Advisory
Related note
3327896
CVSS
7.5

Affected system type Kernel
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40308] Memory Corruption vulnerability in SAP CommonCryptoLib
Security Advisory
Related note
3357163
CVSS
6.3

Affected system type PowerDesigner
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40621] Code Injection vulnerability in SAP PowerDesigner Client
Security Advisory
Related note
3317702
CVSS
6.2

Affected system type BI/BO platform
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40623] Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)
Security Advisory
Related note
3349805
CVSS
5.7

Affected system type Java
Patchday 2023-09
Released on 2023/09/12
Description Denial of service (DOS) vulnerability due to the usage of vulnerable version of Commons File Upload in SAP Quotation Management Insurance (FS-QUO)
Security Advisory
Related note
3323163
CVSS
5.5

Affected system type ABAP
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40624] Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)
Security Advisory
Related note
3326361
CVSS
5.4

Affected system type ABAP
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-40625] Missing Authorization check in Manage Purchase Contracts App
Security Advisory
Related note
3352453
CVSS
5.3

Affected system type BI/BO platform
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-37489] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)
Security Advisory
Related note
3348142
CVSS
5.3

Affected system type Java
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-41367] Missing Authentication check in SAP NetWeaver (Guided Procedures)
Security Advisory
Related note
3369680
CVSS
3.5

Affected system type ABAP
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-41369] External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)
Security Advisory
Related note
3355675
CVSS
2.7

Affected system type ABAP
Patchday 2023-09
Released on 2023/09/12
Description [CVE-2023-41368] Insecure Direct Object Reference (IDOR) vulnerability in SAP S/4HANA (Manage checkbook apps)
Security Advisory
Related note
3341460
CVSS
9.8

Affected system type SAP PowerDesigner
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37483] Multiple Vulnerabilities in SAP PowerDesigner
Security Advisory
Related note
3350297
CVSS
9.1

Affected system type ABAP
Patchday 2023-08
Released on 2023/07/11
Description [CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Security Advisory
Related note
3346500
CVSS
8.8

Affected system type SAP Commerce Cloud
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-39439] Improper authentication in SAP Commerce Cloud
Security Advisory
Related note
3341599
CVSS
7.8

Affected system type SAP PowerDesigner
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-36923] Code Injection vulnerability in SAP PowerDesigner
Security Advisory
Related note
3317710
CVSS
7.6

Affected system type BI/BO platform
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37490] Binary hijack in SAP BusinessObjects Business Intelligence Suite (installer)
Security Advisory
Related note
3358300
CVSS
7.6

Affected system type SAP Business One
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-39437] Cross-Site Scripting (XSS) vulnerability in SAP Business One
Security Advisory
Related note
3344295
CVSS
7.5

Affected system type Kernel
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37491] Improper Authorization check vulnerability in SAP Message Server
Security Advisory
Related note
3312047
CVSS
7.5

Affected system type BI/BO platform
Patchday 2023-08
Released on 2023/08/08
Description Denial of Service (DoS) vulnerability due to the usage of vulnerable version of Commons FileUpload in SAP BusinessObjects Business Intelligence Platform (CMC)
Security Advisory
Related note
3337797
CVSS
7.1

Affected system type SAP Business One
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-33993] SQL Injection vulnerability in SAP Business One (B1i Layer)
Security Advisory
Related note
2032723
CVSS
6.3

Affected system type ABAP
Patchday 2023-08
Released on 2014/11/11
Description Switchable authorization checks for RFC in SRM
Security Advisory
Related note
3350494
CVSS
6.1

Affected system type Java
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37488] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration
Security Advisory
Related note
3156972
CVSS
6.1

Affected system type ABAP
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-40306] URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)
Security Advisory
Related note
3149794
CVSS
6.1

Affected system type SAP UI5
Patchday 2023-08
Released on 2023/08/08
Description Cross-Site Scripting (XSS) vulnerabilities in jQuery-UI library bundled with SAPUI5
Security Advisory
Related note
3341934
CVSS
5.9

Affected system type SAP Commerce Cloud
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37486] Information Disclosure vulnerability in SAP Commerce (OCC API)
Security Advisory
Related note
2067220
CVSS
5.8

Affected system type ABAP
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-39436] Information Disclosure in SAP Supplier Relationship Management
Security Advisory
Related note
3333616
CVSS
5.3

Affected system type SAP Business One
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37487] Security Misconfiguration vulnerability in SAP Business One (Service Layer)
Security Advisory
Related note
3348000
CVSS
4.9

Affected system type ABAP
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-37492] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform
Security Advisory
Related note
3312586
CVSS
4.4

Affected system type BI/BO platform
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-39440] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform
Security Advisory
Related note
3358328
CVSS
3.7

Affected system type SAP Host Agent
Patchday 2023-08
Released on 2023/08/08
Description [CVE-2023-36926] Information disclosure vulnerability in SAP Host Agent
Security Advisory
Related note
3331376
CVSS
8.7

Affected system type ABAP
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-33989] Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)
Security Advisory
Related note
3233899
CVSS
8.6

Affected system type Kernel
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-33987] Request smuggling and request concatenation vulnerability in SAP Web Dispatcher
Security Advisory
Related note
3331029
CVSS
7.8

Affected system type Sybase platform
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-33990] Denial of service (DOS) vulnerability in SAP SQL Anywhere
Security Advisory
Related note
3340735
CVSS
7.7

Affected system type Kernel
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-35871] Memory Corruption vulnerability in SAP Web Dispatcher
Security Advisory
Related note
3352058
CVSS
7.2

Affected system type Java
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-36925] Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)
Security Advisory
Related note
3348145
CVSS
7.2

Affected system type Java
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-36921] Header Injection in SAP Solution Manager (Diagnostic Agent)
Security Advisory
Related note
3343547
CVSS
6.5

Affected system type Java
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-35873] Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)
Security Advisory
Related note
3343564
CVSS
6.5

Affected system type Java
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-35872] Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)
Security Advisory
Related note
3341211
CVSS
6.3

Affected system type ABAP
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-35870] Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)
Security Advisory
Related note
3326769
CVSS
6.1

Affected system type SAP Enable Now
Patchday 2023-07
Released on 2023/07/11
Description [Multiple CVEs] Multiple Vulnerabilities in SAP Enable Now
Security Advisory
Related note
3318850
CVSS
6.0

Affected system type Kernel
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-35874] Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
Security Advisory
Related note
3320702
CVSS
5.9

Affected system type BI/BO platform
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-36917] Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform
Security Advisory
Related note
3324732
CVSS
5.3

Affected system type Java
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-31405] Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
Security Advisory
Related note
3351410
CVSS
4.9

Affected system type ABAP
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-36924] Log Injection vulnerability in SAP ERP Defense Forces and Public Security
Security Advisory
Related note
3088078
CVSS
4.5

Affected system type BI/BO platform
Patchday 2023-07
Released on 2023/07/11
Description [CVE-2023-33992] Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA
Security Advisory
Related note
3324285
CVSS
8.2

Affected system type SAP UI5
Patchday 2023-06
Released on 2023/06/13
Description [CVE-2023-33991] Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management)
Security Advisory
Related note
3318657
CVSS
6.4

Affected system type SAP...
Patchday 2023-06
Released on 2023/06/13
Description [CVE-2023-33984] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (Design Time Repository)
Security Advisory
Related note
3322800
CVSS
6.1

Affected system type ABAP
Patchday 2023-06
Released on 2023/06/13
Description Update 1 to security note 3315971 - [CVE-2023-30742] Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
Security Advisory
Related note
2826092
CVSS
6.1

Affected system type ABAP
Patchday 2023-06
Released on 2023/06/13
Description [CVE-2023-33986] Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)
Security Advisory
Related note
3331627
CVSS
6.1

Affected system type Java
Patchday 2023-06
Released on 2023/06/13
Description [CVE-2023-33985] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (Enterprise Portal)
Security Advisory
Related note
3325642
CVSS
2.7

Affected system type ABAP
Patchday 2023-06
Released on 2023/06/13
Description [CVE-2023-32114] Denial of Service in SAP NetWeaver (Change and Transport System)
Security Advisory
Related note
3328495
CVSS
9.8

Affected system type Reprise License Manager
Patchday 2023-05
Released on 2023/05/09
Description Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager
Security Advisory
Related note
3307833
CVSS
9.1

Affected system type BI/BO platform
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-28762] Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Console)
Security Advisory
Related note
3323415
CVSS
8.2

Affected system type SAP Integrated...
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-29080] Privilege escalation vulnerability in SAP IBP, add-in for Microsoft Excel
Security Advisory
Related note
3317453
CVSS
8.2

Affected system type Java
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-30744] Improper access control during application start-up in SAP AS NetWeaver JAVA
Security Advisory
Related note
3301942
CVSS
7.9

Affected system type SAP Plant Connectivity
Patchday 2023-05
Released on 2023/05/23
Description [CVE-2023-2827] Missing Authentication in SAP Plant Connectivity and Production Connector for SAP Digital Manufacturing
Security Advisory
Related note
3321309
CVSS
7.5

Affected system type SAP Commerce
Patchday 2023-05
Released on 2023/05/09
Description Information Disclosure vulnerability in SAP Commerce (Backoffice)
Security Advisory
Related note
3320145
CVSS
7.5

Affected system type SAP Commerce
Patchday 2023-05
Released on 2023/05/09
Description Denial of service (DOS) in SAP Commerce
Security Advisory
Related note
3320467
CVSS
7.5

Affected system type SAP GUI / Frontend
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-32113] Information Disclosure vulnerability in SAP GUI for Windows
Security Advisory
Related note
3300624
CVSS
7.5

Affected system type SAP PowerDesigner
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-32111] Memory Corruption vulnerability in SAP PowerDesigner (Proxy)
Security Advisory
Related note
3326210
CVSS
7.1

Affected system type ABAP
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-30743] Improper Neutralization of Input in SAPUI5
Security Advisory
Related note
3313484
CVSS
6.3

Affected system type BI/BO platform
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-30740] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform
Security Advisory
Related note
3309935
CVSS
6.1

Affected system type BI/BO platform
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-30741] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform
Security Advisory
Related note
3315971
CVSS
6.1

Affected system type ABAP
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-30742] Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
Security Advisory
Related note
3319400
CVSS
6.1

Affected system type BI/BO platform
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-31406] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform
Security Advisory
Related note
3315979
CVSS
5.4

Affected system type ABAP
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-29188] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
Security Advisory
Related note
3312892
CVSS
5.4

Affected system type ABAP
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-31407] Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation
Security Advisory
Related note
3038911
CVSS
5.0

Affected system type BI/BO platform
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-31404] Information Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Service)
Security Advisory
Related note
1794761
CVSS
4.2

Affected system type ABAP
Patchday 2023-05
Released on 2023/05/23
Description [CVE-2023-32115] SQL Injection in Master Data Synchronization (MDS COMPARE TOOL)
Security Advisory
Related note
3302595
CVSS
3.7

Affected system type BI/BO platform
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-28764] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform
Security Advisory
Related note
2335198
CVSS
2.8

Affected system type ABAP
Patchday 2023-05
Released on 2023/05/09
Description [CVE-2023-32112] Missing Authorization Check in Vendor Master Hierarchy
Security Advisory
Related note
3305369
CVSS
10.0

Affected system type Java
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-27497] Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLogServiceCollector)
Security Advisory
Related note
3298961
CVSS
9.8

Affected system type BI/BO platform
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-28765] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
Security Advisory
Related note
3305907
CVSS
8.7

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29186] Directory Traversal vulnerability in SAP NetWeaver ( BI CONT ADD ON)
Security Advisory
Related note
3312733
CVSS
6.8

Affected system type Java
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-26458] Information Disclosure vulnerability in SAP Landscape Management
Security Advisory
Related note
3311624
CVSS
6.7

Affected system type SAP GUI / Frontend
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29187] DLL Hijacking vulnerability in SapSetup (Software Installation Program)
Security Advisory
Related note
3296378
CVSS
6.5

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-28763] - Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3289994
CVSS
6.5

Affected system type Java
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-28761] Missing Authentication check in SAP NetWeaver Enterprise Portal
Security Advisory
Related note
3275458
CVSS
6.1

Affected system type Kernel
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-27499] Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML
Security Advisory
Related note
3309056
CVSS
6.0

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-27897] Code Injection vulnerability in SAP CRM
Security Advisory
Related note
3269352
CVSS
5.4

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29189] HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)
Security Advisory
Related note
3303060
CVSS
5.3

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29185] Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)
Security Advisory
Related note
3315312
CVSS
5.0

Affected system type Kernel
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29108] IP filter vulnerability in ABAP Platform and SAP Web Dispatcher
Security Advisory
Related note
3316509
CVSS
4.7

Affected system type SAP Commerce
Patchday 2023-04
Released on 2023/04/11
Description Remote Code Execution vulnerability in SAP Commerce
Security Advisory
Related note
3115598
CVSS
4.4

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29109] Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
Security Advisory
Related note
3301457
CVSS
4.3

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-1903] Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)
Security Advisory
Related note
3113349
CVSS
3.7

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29110] Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)
Security Advisory
Related note
3114489
CVSS
3.7

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29112] Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)
Security Advisory
Related note
3117978
CVSS
3.1

Affected system type ABAP
Patchday 2023-04
Released on 2023/04/11
Description [CVE-2023-29111] Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)
Security Advisory
Related note
3245526
CVSS
9.9

Affected system type BI/BO platform
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-25616] Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
Security Advisory
Related note
3252433
CVSS
9.9

Affected system type Java
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-23857] Improper Access Control in SAP NetWeaver AS for Java
Security Advisory
Related note
3294595
CVSS
9.6

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27269] Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3283438
CVSS
9.0

Affected system type BI/BO platform
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-25617] OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)
Security Advisory
Related note
3296476
CVSS
8.8

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27893] Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI)
Security Advisory
Related note
3294954
CVSS
8.7

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27501] Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3296346
CVSS
7.4

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-26459] Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3275727
CVSS
7.2

Affected system type SAP Host Agent
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27498] Memory Corruption vulnerability in SAPOSCOL
Security Advisory
Related note
3289844
CVSS
6.8

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-25615] SQL Injection vulnerability in SAP ABAP Platform
Security Advisory
Related note
3284550
CVSS
6.8

Affected system type Java
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-26461] XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)
Security Advisory
Related note
3287120
CVSS
6.5

Affected system type BI/BO platform
Patchday 2023-03
Released on 2023/03/14
Description [Multiple CVEs] Multiple vulnerabilities in the SAP BusinessObjects Business Intelligence platform
Security Advisory
Related note
3296328
CVSS
6.5

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27270] Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3274920
CVSS
6.1

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-0021] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver
Security Advisory
Related note
3281484
CVSS
6.1

Affected system type ABAP
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-26457] Cross-Site Scripting (XSS) vulnerability in SAP Content Server
Security Advisory
Related note
3302710
CVSS
6.1

Affected system type SAP Authenticator for Android
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27895] Information Disclosure vulnerability in SAP Authenticator for Android
Security Advisory
Related note
3288096
CVSS
5.3

Affected system type Java
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-26460] Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)
Security Advisory
Related note
3288394
CVSS
5.3

Affected system type Java
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-24526] Improper Access Control in SAP NetWeaver AS Java (Classload Service)
Security Advisory
Related note
3288480
CVSS
5.3

Affected system type Java
Patchday 2023-03
Released on 2023/03/14
Description [CVE-2023-27268] Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
Security Advisory
Related note
3285757
CVSS
8.8

Affected system type SAP Host Agent
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24523] Privilege Escalation vulnerability in SAP Host Agent (Start Service)
Security Advisory
Related note
3263135
CVSS
8.5

Affected system type BI/BO platform
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-0020] Information disclosure vulnerability in SAP BusinessObjects Business Intelligence platform
Security Advisory
Related note
3256787
CVSS
8.4

Affected system type BI/BO platform
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24530] Unrestricted Upload of File in SAP BusinessObjects Business Intelligence Platform (CMC)
Security Advisory
Related note
3270509
CVSS
6.5

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23855] URL Redirection vulnerability in SAP Solution Manager
Security Advisory
Related note
3281724
CVSS
6.5

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-0019] Missing Authorization check in SAP GRC (Process Control)
Security Advisory
Related note
3265846
CVSS
6.5

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-0024] Cross Site Scripting in SAP Solution Manager (BSP Application)
Security Advisory
Related note
2985905
CVSS
6.5

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24524] Missing Authorization check in SAP S/4 HANA Map Treasury Correspondence Format Data
Security Advisory
Related note
3290901
CVSS
6.5

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24528] Missing Authorization Check in SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests)
Security Advisory
Related note
3267442
CVSS
6.5

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-0025] Cross Site Scripting in SAP Solution Manager (BSP Application)
Security Advisory
Related note
3266751
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23852] Cross-Site Scripting (XSS) vulnerability in SAP Solution Manager 7.2
Security Advisory
Related note
3274585
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-25614] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)
Security Advisory
Related note
3271227
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23853] URL Redirection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
Security Advisory
Related note
3293786
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23858] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3269118
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24522] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)
Security Advisory
Related note
3268959
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [Multiple CVEs] Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3269151
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24521] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework)
Security Advisory
Related note
3282663
CVSS
6.1

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24529] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application)
Security Advisory
Related note
3275841
CVSS
5.4

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23851] Unrestricted File Upload in SAP Business Planning and Consolidation
Security Advisory
Related note
2788178
CVSS
4.3

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-24525] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI
Security Advisory
Related note
3263863
CVSS
4.3

Affected system type BI/BO platform
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23856] Cross-Site Scripting (XSS) vulnerability in Web Intelligence Interface
Security Advisory
Related note
3287291
CVSS
3.8

Affected system type ABAP
Patchday 2023-02
Released on 2023/02/14
Description [CVE-2023-23854] Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform
Security Advisory
Related note
3275391
CVSS
9.9

Affected system type SAP Business Planning...
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0016] SQL Injection vulnerability in SAP Business Planning and Consolidation MS
Security Advisory
Related note
3262810
CVSS
9.9

Affected system type BI/BO platform
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0022] Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
Security Advisory
Related note
3268093
CVSS
9.4

Affected system type Java
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0017] Improper access control in SAP NetWeaver AS for Java
Security Advisory
Related note
3089413
CVSS
9.0

Affected system type Kernel / ABAP
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0014] Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3276120
CVSS
6.4

Affected system type SAP Host Agent
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0012] Local Privilege Escalation in SAP Host Agent (Windows)
Security Advisory
Related note
3283283
CVSS
6.1

Affected system type ABAP
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0013] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Security Advisory
Related note
3266006
CVSS
5.4

Affected system type BI/BO platform
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0018] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)
Security Advisory
Related note
3251447
CVSS
4.6

Affected system type BI/BO platform
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0015] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence)
Security Advisory
Related note
3150704
CVSS
4.5

Affected system type ABAP
Patchday 2023-01
Released on 2023/01/10
Description [CVE-2023-0023] Information Disclosure in SAP Bank Account Management (Manage Banks)
Security Advisory