SAP Security Patch Day, June 2018: the CVEs

SAP Security Patch Day June 2018: the CVEs SAP published on 12 June 2018, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: May 2018, Apr 2018, Mar 2018, Feb 2018, Jan 2018, Dec 2017, Nov 2017, Oct 2017, Sep 2017, Aug 2017, Jul 2017, Jun 2017. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 5.3CVE-2018-2428EPSS 1.7%2018-06-12

   Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP …

2. 5.5CVE-2018-2425EPSS 0.4%2018-06-12

   Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.

3. 7.5CVE-2018-2424EPSS 2.3%2018-06-12

   SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Databa…