cve.bz

SAP Security Patch Day, January 2019: the CVEs

Filter

SAP Security Patch Day January 2019: the CVEs SAP published on 8 January 2019, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Dec 2018, Nov 2018, Oct 2018, Sep 2018, Aug 2018, Jul 2018, Jun 2018, May 2018, Apr 2018, Mar 2018, Feb 2018, Jan 2018. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 7.5CVE-2019-0249EPSS 1.7%

    Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.

  2. 5.9CVE-2019-0248EPSS 1.6%

    Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.

  3. 9.8CVE-2019-0247EPSS 1.3%

    SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

  4. 9.8CVE-2019-0246EPSS 2.7%

    SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.

  5. 5.4CVE-2019-0245EPSS 0.8%

    SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

  6. 5.4CVE-2019-0244EPSS 0.8%

    SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

  7. 8.8CVE-2019-0243EPSS 1.7%

    Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

  8. 7.5CVE-2019-0241EPSS 2.0%

    SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

  9. 7.5CVE-2019-0240EPSS 2.0%

    SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legitimate users from accessing the application by crashing it.

  10. 6.1CVE-2019-0238EPSS 1.0%

    SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

  11. 7.5CVE-2018-2499EPSS 1.7%

    A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash of an admin user.

  12. 8.8CVE-2018-2484EPSS 1.4%

    SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization check…