SAP Security Patch Day, April 2024: the CVEs
Filter
SAP Security Patch Day April 2024: the CVEs SAP published on 9 April 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Mar 2024, Feb 2024, Jan 2024, Dec 2023, Nov 2023, Oct 2023, Sep 2023, Aug 2023, Jul 2023, Jun 2023, May 2023, Apr 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 6.5CVE-2024-30218EPSS 0.5%
The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability.
- 4.3CVE-2024-30217EPSS 0.3%
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can approve or reject a bank account applicatio…
- 4.3CVE-2024-30216EPSS 0.3%
Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, attacker can add notes in the review request with 'complete…
- 4.8CVE-2024-30215EPSS 0.3%
The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a successful attack, some information could be obtained and/or modified. However, the at…
- 4.8CVE-2024-30214EPSS 0.3%
The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script …
- 6.5CVE-2024-28167EPSS 0.4%
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app a…
- 7.2CVE-2024-27901EPSS 0.7%
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integri…
- 8.8CVE-2024-27899EPSS 0.4%
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause …
- 5.3CVE-2024-27898EPSS 0.4%
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from …
- 6.5CVE-2024-25646EPSS 0.4%
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact…