cve.bz

SAP Security Patch Day, January 2024: the CVEs

Filter

SAP Security Patch Day January 2024: the CVEs SAP published on 9 January 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Dec 2023, Nov 2023, Oct 2023, Sep 2023, Aug 2023, Jul 2023, Jun 2023, May 2023, Apr 2023, Mar 2023, Feb 2023, Jan 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 7.5CVE-2024-22125EPSS 0.5%

    Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confid…

  2. 7.5CVE-2024-22124EPSS 0.3%

    Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WE…

  3. 5.4CVE-2024-21738EPSS 0.3%

    SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality o…

  4. 9.1CVE-2024-21737EPSS 0.6%

    In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the app…

  5. 6.5CVE-2024-21736EPSS 0.3%

    SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading…

  6. 7.2CVE-2024-21735EPSS 0.4%

    SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, r…

  7. 5.4CVE-2024-21734EPSS 0.2%

    SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead to a very convincing phishing attack with low impact on confidentiality and integrity of the applica…