SAP vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
181 matching records
- High8.2SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production.Check if you run itEPSS 0.36%Dec 9, 2025
- High7.5SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerabilCheck if you run itEPSS 0.54%Dec 9, 2025
- High7.1Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single compaCheck if you run itEPSS 0.30%Dec 9, 2025
- Medium6.6The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, vCheck if you run itEPSS 0.34%Dec 9, 2025
- High7.9SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input valiCheck if you run itEPSS 0.47%Dec 9, 2025
- Medium5.9SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities.Check if you run itEPSS 0.38%Dec 9, 2025
- Medium6.1Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of otheCheck if you run itEPSS 0.26%Dec 9, 2025
- High7.8A Use-After-Free vulnerability has been discovered in GRUB's gettext module.Check if you run itEPSS 0.22%Nov 18, 2025
- High7.5SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network.Check if you run itEPSS 0.45%Nov 11, 2025
- Medium6.1SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page controlled by the atCheck if you run itEPSS 0.22%Nov 11, 2025
- Medium5.3Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs.Check if you run itEPSS 0.50%Nov 11, 2025
- Medium4.3SAP S4CORE (Manage journal entries) does not perform necessary authorization checks for an authenticated user resulting in escalation of privileges.Check if you run itEPSS 0.26%Nov 11, 2025
- Medium5.3Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gain access to unauthorized information.Check if you run itEPSS 0.25%Nov 11, 2025
- Medium6.9Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted parameters that lead toCheck if you run itEPSS 0.17%Nov 11, 2025
- Medium6.8Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitraCheck if you run itEPSS 0.30%Nov 11, 2025
- Medium6.1Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attackeCheck if you run itEPSS 0.24%Nov 11, 2025
- Medium6.8Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafCheck if you run itEPSS 0.79%Nov 11, 2025
- Critical10.0SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitraryCheck if you run itEPSS 0.69%Nov 11, 2025
- Medium5.4SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database.Check if you run itEPSS 0.20%Nov 11, 2025
- Medium5.5SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerabilityCheck if you run itEPSS 0.12%Nov 11, 2025
- Critical9.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module.Check if you run itEPSS 0.60%Nov 11, 2025
- Medium6.1Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible.Check if you run itEPSS 0.26%Nov 11, 2025
- Medium5.8Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable them to view information.Check if you run itEPSS 0.33%Nov 11, 2025
- Medium6.5SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an uniCheck if you run itEPSS 0.28%Nov 11, 2025
- Low2.7Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to theCheck if you run itEPSS 0.27%Nov 11, 2025