cve.bz

SAP Security Patch Day, October 2023: the CVEs

Filter

SAP Security Patch Day October 2023: the CVEs SAP published on 10 October 2023, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Sep 2023, Aug 2023, Jul 2023, Jun 2023, May 2023, Apr 2023, Mar 2023, Feb 2023, Jan 2023, Dec 2022, Nov 2022, Oct 2022. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 6.5CVE-2023-42477EPSS 0.5%

    SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.

  2. 4.3CVE-2023-42475EPSS 0.5%

    The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

  3. 5.4CVE-2023-42474EPSS 0.4%

    SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive informa…

  4. 5.4CVE-2023-42473EPSS 0.3%

    S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the applica…

  5. 4.3CVE-2023-41365EPSS 0.4%

    SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attack…

  6. 7.5CVE-2023-40310EPSS 3.6%

    SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A succe…