cve.bz

SAP Security Patch Day, November 2022: the CVEs

Filter

SAP Security Patch Day November 2022: the CVEs SAP published on 8 November 2022, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Oct 2022, Sep 2022, Aug 2022, Jul 2022, Jun 2022, May 2022, Apr 2022, Mar 2022, Feb 2022, Jan 2022, Dec 2021, Nov 2021. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 6.1CVE-2022-41260EPSS 0.6%

    SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web script via a GET request. On successful exploitation, an attacker can view or modify…

  2. 6.5CVE-2022-41259EPSS 0.9%

    SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use an ARRAY constructor.

  3. 6.5CVE-2022-41258EPSS 0.5%

    Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an att…

  4. 4.7CVE-2022-41215EPSS 0.5%

    SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.

  5. 8.7CVE-2022-41214EPSS 0.9%

    Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful expl…

  6. 4.9CVE-2022-41212EPSS 0.9%

    Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to read a file which is otherwise restricted. On successful exploi…

  7. 7.8CVE-2022-41211EPSS 0.4%

    Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload fo…

  8. 5.4CVE-2022-41208EPSS 0.5%

    Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user session. On successful exploitation, the attacker can view or modify information,…

  9. 6.1CVE-2022-41207EPSS 0.5%

    SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victim to a malicious site of the attacker's choosing whi…

  10. 6.1CVE-2022-41205EPSS 0.2%

    SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of…

  11. 8.8CVE-2022-41203EPSS 1.1%

    In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious seri…