cve.bz

SAP Security Patch Day, November 2024: the CVEs

Filter

SAP Security Patch Day November 2024: the CVEs SAP published on 12 November 2024, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Oct 2024, Sep 2024, Aug 2024, Jul 2024, Jun 2024, May 2024, Apr 2024, Mar 2024, Feb 2024, Jan 2024, Dec 2023, Nov 2023. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 7.1CVE-2024-47595EPSS 0.1%

    An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high impact on confidentiality and integrity of the application.

  2. 4.3CVE-2024-47593EPSS 0.4%

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server i…

  3. 5.3CVE-2024-47592EPSS 0.3%

    SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.

  4. 8.8CVE-2024-47590EPSS 0.8%

    An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which whe…

  5. 4.7CVE-2024-47588EPSS 0.1%

    In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a no…

  6. 3.5CVE-2024-47587EPSS 0.3%

    Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application.

  7. 5.3CVE-2024-47586EPSS 3.5%

    SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the syste…

  8. 6.5CVE-2024-42372EPSS 0.3%

    Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the applicat…