SAP Security Patch Day, October 2024: the CVEs
Filter
SAP Security Patch Day October 2024: the CVEs SAP published on 8 October 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Sep 2024, Aug 2024, Jul 2024, Jun 2024, May 2024, Apr 2024, Mar 2024, Feb 2024, Jan 2024, Dec 2023, Nov 2023, Oct 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 5.4CVE-2024-47594EPSS 0.3%
SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim …
- 5.3CVE-2024-45282EPSS 0.3%
Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably immutable method is not protected against extern…
- 5.4CVE-2024-45278EPSS 0.3%
SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the…
- 4.3CVE-2024-45277EPSS 0.6%
The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary properties to global object prototypes. This is due to improper user input sanita…
- 6.5CVE-2024-37179EPSS 0.4%
SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to download any file from the machine hosting the service, causing high impact on …