CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 12/12/2017 |
| CVE-2017-16683 | MOYENNE6.5 | Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a service. | 12/12/2017 |
| CVE-2017-16682 | ÉLEVÉE7.2 | SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application. | 12/12/2017 |
| CVE-2017-16681 | MOYENNE6.1 | Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user controlled inputs are not sufficiently encoded. | 12/12/2017 |
| CVE-2017-16680 | ÉLEVÉE7.5 | Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input validation which could allow unprivileged attackers to forge audit log lines. Hence the interpretation of audit log files could be hindered or mis | 12/12/2017 |
| CVE-2017-16678 | MOYENNE4.7 | Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application. | 12/12/2017 |
| CVE-2017-15297 | ÉLEVÉE7.5 | SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993. | 16/10/2017 |
| CVE-2017-15296 | ÉLEVÉE8.8 | The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964. | 16/10/2017 |
| CVE-2017-15295 | CRITIQUE9.8 | Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064. | 16/10/2017 |
| CVE-2017-15294 | MOYENNE6.1 | The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964. | 16/10/2017 |
| CVE-2017-15293 | CRITIQUE9.8 | Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064. | 16/10/2017 |
| CVE-2017-10701 | MOYENNE6.1 | Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka SAP Security Notes 2469860, 2471209, and 2488516. | 29/09/2017 |
| CVE-2017-14581 | ÉLEVÉE7.5 | The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181. | 19/09/2017 |
| CVE-2017-14511 | ÉLEVÉE7.5 | An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and confirm email addresses | 17/09/2017 |
| CVE-2015-7241 | CRITIQUE9.8 | XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. | 06/09/2017 |
| CVE-2014-8871 | ÉLEVÉE7.5 | Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier, 5.1.0.1 and earlier, 5.1.1.2 and earlier, 5.2.0.3 and earlier, and 5.3.0.1 and earlier. | 28/08/2017 |
| CVE-2017-12637KEV | ÉLEVÉE7.5 | Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. | 07/08/2017 |
| CVE-2017-11460 | MOYENNE6.1 | Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script or HTML via the responsecode parameter to shp/shp_result.jsp, aka SAP Security Note 2308535. | 25/07/2017 |