cve.bz

SAP Security Patch Day, August 2023: the CVEs

Filter

SAP Security Patch Day August 2023: the CVEs SAP published on 8 August 2023, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Jul 2023, Jun 2023, May 2023, Apr 2023, Mar 2023, Feb 2023, Jan 2023, Dec 2022, Nov 2022, Oct 2022, Sep 2022, Aug 2022. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 4.4CVE-2023-39440EPSS 0.1%

    In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user cr…

  2. 9.8CVE-2023-39439EPSS 0.7%

    SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.

  3. 5.4CVE-2023-39437EPSS 0.4%

    SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action aff…

  4. 5.8CVE-2023-39436EPSS 0.4%

    SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This i…

  5. 6.5CVE-2023-37492EPSS 0.5%

    SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BAS…

  6. 8.8CVE-2023-37491EPSS 0.5%

    The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which…

  7. 9.0CVE-2023-37490EPSS 0.3%

    SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a m…

  8. 6.1CVE-2023-37488EPSS 0.4%

    In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker…

  9. 5.3CVE-2023-37487EPSS 0.5%

    SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which could lead to high impact on confidentiality with no impact on…

  10. 7.5CVE-2023-37486EPSS 0.5%

    Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high im…

  11. 5.3CVE-2023-37484EPSS 2.0%

    SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.

  12. 9.8CVE-2023-37483EPSS 4.8%

    SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.

  13. 5.3CVE-2023-36926EPSS 0.5%

    Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather som…

  14. 7.8CVE-2023-36923EPSS 0.2%

    SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the b…

  15. 7.5CVE-2023-33993EPSS 0.6%

    B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high im…