cve.bz

SAP Security Patch Day, September 2023: the CVEs

Filter

SAP Security Patch Day September 2023: the CVEs SAP published on 12 September 2023, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Aug 2023, Jul 2023, Jun 2023, May 2023, Apr 2023, Mar 2023, Feb 2023, Jan 2023, Dec 2022, Nov 2022, Oct 2022, Sep 2022. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 5.4CVE-2023-40625EPSS 0.4%

    S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation o…

  2. 5.4CVE-2023-40624EPSS 0.4%

    SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the w…

  3. 7.1CVE-2023-40623EPSS 0.4%

    SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker c…

  4. 9.9CVE-2023-40622EPSS 0.7%

    SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation…

  5. 6.3CVE-2023-40621EPSS 2.9%

    SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has…

  6. 9.8CVE-2023-40309EPSS 0.9%

    SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of…

  7. 7.3CVE-2023-42472EPSS 0.6%

    Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When …

  8. 4.3CVE-2023-41369EPSS 0.5%

    The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets …

  9. 5.3CVE-2023-41368EPSS 0.4%

    The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.

  10. 5.3CVE-2023-41367EPSS 0.5%

    Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerabi…

  11. 7.5CVE-2023-40308EPSS 0.8%

    SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There i…

  12. 5.3CVE-2023-37489EPSS 0.5%

    Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidential…