cve.bz

SAP Security Patch Day, May 2019: the CVEs

Filter

SAP Security Patch Day May 2019: the CVEs SAP published on 14 May 2019, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Apr 2019, Mar 2019, Feb 2019, Jan 2019, Dec 2018, Nov 2018, Oct 2018, Sep 2018, Aug 2018, Jul 2018, Jun 2018, May 2018. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 8.8CVE-2019-0301EPSS 1.1%

    Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing.

  2. 6.1CVE-2019-0298EPSS 1.3%

    SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP…

  3. 6.5CVE-2019-0293EPSS 1.4%

    Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008…

  4. 5.5CVE-2019-0291EPSS 0.4%

    Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.

  5. 7.1CVE-2019-0289EPSS 1.1%

    Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

  6. 7.6CVE-2019-0287EPSS 1.7%

    Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

  7. 8.8CVE-2019-0280EPSS 1.1%

    SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting …