cve.bz

SAP Security Patch Day, April 2018: the CVEs

Filter

SAP Security Patch Day April 2018: the CVEs SAP published on 10 April 2018, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Mar 2018, Feb 2018, Jan 2018, Dec 2017, Nov 2017, Oct 2017, Sep 2017, Aug 2017, Jul 2017, Jun 2017, May 2017, Apr 2017. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 8.8CVE-2018-2413EPSS 1.4%

    SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

  2. 8.8CVE-2018-2412EPSS 1.4%

    SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

  3. 5.4CVE-2018-2410EPSS 0.9%

    SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.

  4. 8.8CVE-2018-2409EPSS 1.2%

    Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platfo…

  5. 7.3CVE-2018-2408EPSS 1.5%

    Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a user, all other active sessions created using older password continues to be ac…

  6. 5.3CVE-2018-2406EPSS 0.3%

    Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path.

  7. 5.4CVE-2018-2405EPSS 0.9%

    SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting.

  8. 9.8CVE-2018-2404EPSS 1.8%

    SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.

  9. 6.5CVE-2018-2403EPSS 1.1%

    Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an authorized user to get SAP Disclosure Management to point a specific chapter type …