cve.bz

SAP Security Patch Day, May 2024: the CVEs

Filter

SAP Security Patch Day May 2024: the CVEs SAP published on 14 May 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Apr 2024, Mar 2024, Feb 2024, Jan 2024, Dec 2023, Nov 2023, Oct 2023, Sep 2023, Aug 2023, Jul 2023, Jun 2023, May 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 4.3CVE-2024-4139EPSS 0.3%

    Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affect…

  2. 4.3CVE-2024-4138EPSS 0.3%

    Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of…

  3. 9.0CVE-2024-34687EPSS 0.4%

    SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, wh…

  4. 4.2CVE-2024-33009EPSS 0.3%

    SAP Global Label Management is vulnerable to SQL injection. On exploitation the attacker can use specially crafted inputs to modify database commands resulting in the retrieval of additional information persisted by the system. This could …

  5. 4.9CVE-2024-33008EPSS 0.5%

    SAP Replication Server allows an attacker to use gateway for executing some commands to RSSD. This could result in crashing the Replication Server due to memory corruption with high impact on Availability of the system.

  6. 3.5CVE-2024-33007EPSS 0.3%

    PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaS…

  7. 9.6CVE-2024-33006EPSS 0.5%

    An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.

  8. 4.3CVE-2024-33004EPSS 0.2%

    SAP Business Objects Business Intelligence Platform is vulnerable to Insecure Storage as dynamic web pages are getting cached even after logging out. On successful exploitation, the attacker can see the sensitive information through cache …

  9. 6.1CVE-2024-33002EPSS 0.3%

    Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application.

  10. 3.5CVE-2024-33000EPSS 0.3%

    SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system.

  11. 6.1CVE-2024-32733EPSS 0.4%

    Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On…

  12. 5.5CVE-2024-32731EPSS 0.4%

    SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request …

  13. 9.3CVE-2024-28165EPSS 0.6%

    SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application

  14. 6.5CVE-2024-32730EPSS 0.6%

    SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's dat…