cve.bz

SAP Security Patch Day, June 2024: the CVEs

Filter

SAP Security Patch Day June 2024: the CVEs SAP published on 11 June 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: May 2024, Apr 2024, Mar 2024, Feb 2024, Jan 2024, Dec 2023, Nov 2023, Oct 2023, Sep 2023, Aug 2023, Jul 2023, Jun 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 5.4CVE-2024-37176EPSS 0.3%

    SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has n…

  2. 6.5CVE-2024-34691EPSS 0.3%

    Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confid…

  3. 5.4CVE-2024-34690EPSS 0.2%

    SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-…

  4. 7.5CVE-2024-34688EPSS 0.5%

    Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confiden…

  5. 6.1CVE-2024-34686EPSS 0.3%

    Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser givin…

  6. 6.0CVE-2024-34684EPSS 0.1%

    On Unix, SAP BusinessObjects Business Intelligence Platform (Scheduling) allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-admi…

  7. 6.5CVE-2024-34683EPSS 0.2%

    An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser.

  8. 6.5CVE-2024-33001EPSS 0.4%

    SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions…

  9. 5.3CVE-2024-28164EPSS 0.3%

    SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

  10. 5.0CVE-2024-37178EPSS 0.3%

    SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulner…

  11. 8.1CVE-2024-37177EPSS 0.4%

    SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an att…