SAP Security Patch Day, August 2021: the CVEs

SAP Security Patch Day August 2021: the CVEs SAP published on 10 August 2021, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Jul 2021, Jun 2021, May 2021, Apr 2021, Mar 2021, Feb 2021, Jan 2021, Dec 2020, Nov 2020, Oct 2020, Sep 2020, Aug 2020. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 6.1CVE-2021-33707EPSS 2.0%2021-08-10

   SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and in…

2. 4.3CVE-2021-33706EPSS 0.6%2021-08-10

   Due to improper input validation in InfraBox, logs can be modified by an authenticated user.

3. 6.1CVE-2021-33703EPSS 1.5%2021-08-10

   Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected…

4. 6.1CVE-2021-33702EPSS 1.5%2021-08-10

   Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, …

5. 6.5CVE-2021-33699EPSS 1.2%2021-08-10

   Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Task Control features. This allows an unauthorized attacker or malware to takeover…