cve.bz

SAP Security Patch Day, June 2023: the CVEs

Filter

SAP Security Patch Day June 2023: the CVEs SAP published on 13 June 2023, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: May 2023, Apr 2023, Mar 2023, Feb 2023, Jan 2023, Dec 2022, Nov 2022, Oct 2022, Sep 2022, Aug 2022, Jul 2022, Jun 2022. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 8.2CVE-2023-33991EPSS 0.5%

    SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (St…

  2. 6.1CVE-2023-33986EPSS 0.4%

    SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause lim…

  3. 6.1CVE-2023-33985EPSS 0.5%

    SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successfu…

  4. 5.4CVE-2023-33984EPSS 0.4%

    SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email…

  5. 6.1CVE-2023-32115EPSS 0.2%

    An attacker can exploit MDS COMPARE TOOL and use specially crafted inputs to read and modify database commands, resulting in the retrieval of additional information persisted by the system.

  6. 2.7CVE-2023-32114EPSS 0.6%

    SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or mak…

  7. 5.7CVE-2023-2827EPSS 0.3%

    SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON Web Token (JWT) in the HTTP request sent from SAP Digital Manufacturing. Therefo…