cve.bz

SAP Security Patch Day, February 2021: the CVEs

Filter

SAP Security Patch Day February 2021: the CVEs SAP published on 9 February 2021, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Jan 2021, Dec 2020, Nov 2020, Oct 2020, Sep 2020, Aug 2020, Jul 2020, Jun 2020, May 2020, Apr 2020, Mar 2020, Feb 2020. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 9.1CVE-2021-21479ExploitEPSS 10%

    In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.

  2. 6.1CVE-2021-21478EPSS 0.9%

    SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

  3. 9.9CVE-2021-21477EPSS 30%

    SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which whe…

  4. 6.1CVE-2021-21476EPSS 0.8%

    SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities.

  5. 7.5CVE-2021-21475EPSS 1.9%

    Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent di…

  6. 6.5CVE-2021-21474EPSS 0.7%

    SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that t…

  7. 8.8CVE-2021-21472EPSS 1.2%

    SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this allows an authenticated attacker to perform various security attacks like Directo…

  8. 6.1CVE-2021-21444EPSS 0.8%

    SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Fram…