cve.bz

SAP Security Patch Day, March 2024: the CVEs

Filter

SAP Security Patch Day March 2024: the CVEs SAP published on 12 March 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Feb 2024, Jan 2024, Dec 2023, Nov 2023, Oct 2023, Sep 2023, Aug 2023, Jul 2023, Jun 2023, May 2023, Apr 2023, Mar 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 5.3CVE-2024-28163EPSS 0.4%

    Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on In…

  2. 6.1CVE-2024-27902EPSS 0.5%

    Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious atta…

  3. 5.3CVE-2024-27900EPSS 0.4%

    Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be acces…

  4. 5.3CVE-2024-25645EPSS 0.4%

    Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity …

  5. 5.3CVE-2024-25644EPSS 0.4%

    Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.

  6. 6.5CVE-2024-22133EPSS 0.3%

    SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiali…

  7. 9.1CVE-2024-22127EPSS 1.6%

    SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the atta…