Security Advisories for SAP©

Security Advisories

We've created the first of its kind, SecurityBridge ^{Cloud Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 277 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 277

System Types

Affected SAP© system types

_{Related note}
2963592

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27601] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
3036436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27604] Potential XXE Vulnerability in SAP Process Integration (ESR Java Mappings)

Security Advisory

_{Related note}
2818965

_CVSS
4.6

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Clickjacking vulnerability in Runtime Workbench of SAP Process Integration

Security Advisory

_{Related note}
3017908

_CVSS
8.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21482] Information Disclosure in SAP NetWeaver Master Data Management

Security Advisory

_{Related note}
2911863

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Information Disclosure in BOE/CMC application

Security Advisory

_{Related note}
3025054

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27605 ] Missing Authorization check in HCM Travel Management Fiori Apps V2

Security Advisory

_{Related note}
3035472

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-04

_{Released
on}
2021/03/18

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3027937

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27598] Improper Access Control in SAP NetWeaver AS for Java (Customer Usage Provisioning Servlet)

Security Advisory

_{Related note}
3036679

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
Update 1 to Security Note 1576763: Potential information disclosure relating to usernames

Security Advisory

_{Related note}
3028729

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27603] Denial of Service (DoS) in SAP NetWeaver AS of ABAP

Security Advisory

_{Related note}
3012277

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27599] Information Disclosure in SAP Process Integration (Integration Builder Framework)

Security Advisory

_{Related note}
3025637

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21492] Content spoofing in NetWeaver AS Java HTTP Service

Security Advisory

_{Related note}
3005802

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-04

_{Released
on}
2021/03/23

Description
Cross-Site Request Forgery (CSRF) vulnerability in S/4HANA Finance for advanced payment management

Security Advisory

_{Related note}
3001824

_CVSS
7.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21485] Information Disclosure in SAP NetWeaver AS for Java (Telnet Commands)

Security Advisory

_{Related note}
3030948

_CVSS
4.6

_{Affected system
type}
SAP Solution Manager...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27609] Missing Authorization check in SAP Focused RUN

Security Advisory

_{Related note}
3024414

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27600 ] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Execution (System Rules)

Security Advisory

_{Related note}
3039649

_CVSS
7.5

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27608] Unquoted Search Path in SAPSetup

Security Advisory

_{Related note}
3017823

_CVSS
8.2

_{Affected system
type}
SAP Solution Manager

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-21483] Information Disclosure in SAP Solution Manager

Security Advisory

_{Related note}
3040210

_CVSS
9.9

_{Affected system
type}
SAP Commerce / SAP...

_Patchday
2021-04

_{Released
on}
2021/04/13

Description
[CVE-2021-27602] Remote Code Execution vulnerability in Source Rules of SAP Commerce

Security Advisory

_{Related note}
2983436

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21488] Insecure deserialisation in SAP NetWeaver Knowledge Management

Security Advisory

_{Related note}
2475705

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/02/23

Description
Switchable Authorization checks for RFC in In House Cash

Security Advisory

_{Related note}
2976947

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21491] Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on Web Dynpro Java)

Security Advisory

_{Related note}
2977001

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
Reverse TabNabbing vulnerability in SAP NetWeaver Application Server Java (Applications based on HTMLB for Java)

Security Advisory

_{Related note}
3027767

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-27592] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3022622

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21480] Code injection vulnerability in SAP Manufacturing Integration and Intelligence

Security Advisory

_{Related note}
3017378

_CVSS
7.7

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21484] Possible authentication bypass in SAP HANA LDAP scenarios

Security Advisory

_{Related note}
3027758

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Enterprise

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
3023778

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21487] Missing Authorization Check in Payment Engine

Security Advisory

_{Related note}
3007888

_CVSS
6.8

_{Affected system
type}
ABAP

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21486] Missing Authorization check in SAP Enterprise Financial Services( Bank Customer Accounts )

Security Advisory

_{Related note}
2978151

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
Reverse tabnabbing issue in Unified Rendering based frameworks in NetWeaver Application Server Java

Security Advisory

_{Related note}
3022422

_CVSS
9.6

_{Affected system
type}
Java

_Patchday
2021-03

_{Released
on}
2021/03/09

Description
[CVE-2021-21481] Missing Authorization Check in SAP NetWeaver AS JAVA (MigrationService)

Security Advisory

_{Related note}
2990992

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Missing Authorization Checks in the Monitor Data and My Data Collections Apps

Security Advisory

_{Related note}
3000897

_CVSS
4.0

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21475] Directory Traversal vulnerability in SAP NetWeaver Master Data Management 7.1

Security Advisory

_{Related note}
2994289

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Reverse Tabnabbing vulnerability within SAP CRM WebClient UI

Security Advisory

_{Related note}
2835240

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Clickjacking vulnerability in Cloud Integration Content of SAP Process Integration

Security Advisory

_{Related note}
3014121

_CVSS
9.9

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21477] Remote Code Execution vulnerability in SAP Commerce

Security Advisory

_{Related note}
2818963

_CVSS
0.0

_{Affected system
type}
Java

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Clickjacking vulnerability in Adapter Runtime of SAP Process Integration

Security Advisory

_{Related note}
2935791

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21444] Clickjacking vulnerability in SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad)

Security Advisory

_{Related note}
2998173

_CVSS
6.3

_{Affected system
type}
SAP Netweaver

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21472] Server password not set during installation of SAP NetWeaver Master Data Management 7.1

Security Advisory

_{Related note}
2992154

_CVSS
4.1

_{Affected system
type}
SAP HANA Platform

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21474] SAML Assertion Signature MD5 Digest Algorithm Vulnerability in SAP HANA Database

Security Advisory

_{Related note}
2973428

_CVSS
4.7

_{Affected system
type}
Kernal

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
Reverse Tabnabbing vulnerability within SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

Security Advisory

_{Related note}
2974582

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2021-02

_{Released
on}
2021/02/09

Description
[CVE-2021-21478] Reverse Tabnabbing vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP)

Security Advisory

_{Related note}
3000291

_CVSS
3.6

_{Affected system
type}
Analysis for Office

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21470] XML External Entity vulnerability in SAP EPM add-in

Security Advisory

_{Related note}
3000306

_CVSS
7.5

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21446] Denial of service (DOS) in SAP NetWeaver AS ABAP and ABAP Platform

Security Advisory

_{Related note}
2743329

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
Switchable authorization checks for RFC module in In-House-Cash.

Security Advisory

_{Related note}
3001373

_CVSS
8.9

_{Affected system
type}
Cloud Foundry

_Patchday
2021-01

_{Released
on}
2020/12/22

Description
Information Disclosure in Central Order

Security Advisory

_{Related note}
2665387

_CVSS
5.5

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
Cross-Site Request Forgery (CSRF) vulnerability in Cash Management

Security Advisory

_{Related note}
3008422

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21467] Missing Authorization check in SAP Banking Services (Generic Market Data)

Security Advisory

_{Related note}
2993032

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21469] Information Disclosure in SAP NetWeaver Master Data Management

Security Advisory

_{Related note}
3002617

_CVSS
4.3

_{Affected system
type}
Visual Enterprise

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
2992269

_CVSS
5.3

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21448] Information Disclosure in SAP GUI for Windows

Security Advisory

_{Related note}
2999854

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21466] Code Injection in SAP Business Warehouse and SAP BW/4HANA

Security Advisory

_{Related note}
2984034

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21445] Header Manipulation vulnerability in SAP Commerce Cloud

Security Advisory

_{Related note}
2965154

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21447] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Security Advisory

_{Related note}
2986980

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2021-01

_{Released
on}
2021/01/12

Description
[CVE-2021-21465] Multiple vulnerabilities in SAP Business Warehouse (Database Interface)

Security Advisory

_{Related note}
2989719

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-12

_{Released
on}
2020/11/24

Description
Missing Authorization check in S/4HANA (Central Finance)

Security Advisory

_{Related note}
2983367

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26838] Code Injection vulnerability in SAP Business Warehouse (Master Data Management) and SAP BW4HANA

Security Advisory

_{Related note}
2974774

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26829] Missing Authentication Check in SAP NetWeaver AS JAVA (P2P Cluster Communication)

Security Advisory

_{Related note}
2971163

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26816] Missing Encryption in SAP NetWeaver AS Java (Key Storage Service)

Security Advisory

_{Related note}
2996479

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26835] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
2983204

_CVSS
8.5

_{Affected system
type}
SAP Solution Manager

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26837] Multiple Vulnerabilities in SAP Solution Manager 7.2 (User Experience Monitoring)

Security Advisory

_{Related note}
2974330

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26826] Unrestricted File Upload vulnerability in SAP NetWeaver Application Server for Java (Process Integration Monitoring)

Security Advisory

_{Related note}
2978768

_CVSS
4.2

_{Affected system
type}
HANA Platform

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26834 ] Improper authentication in SAP HANA database

Security Advisory

_{Related note}
2993132

_CVSS
7.6

_{Affected system
type}
ABAP

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26832] Missing Authorization check in SAP NetWeaver AS ABAP and SAP S4 HANA (SAP Landscape Transformation)

Security Advisory

_{Related note}
2989075

_CVSS
9.6

_{Affected system
type}
BI/BO platform

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26831] Missing XML Validation in SAP BusinessObjects Business Intelligence Platform (Crystal Report)

Security Advisory

_{Related note}
2938650

_CVSS
3.4

_{Affected system
type}
ABAP

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26836] Open Redirect in SAP Solution Manager (Trace Analysis)

Security Advisory

_{Related note}
2971180

_CVSS
5.4

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-12

_{Released
on}
2020/12/08

Description
[CVE-2020-26828] Formula Injection in SAP Disclosure Management

Security Advisory

_{Related note}
2264508

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/10/27

Description
SQL Injection in SAF-T Portugal

Security Advisory

_{Related note}
2952084

_CVSS
4.9

_{Affected system
type}
Java

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26814] Information Disclosure in SAP Process Integration (PGP Module – Business-to-Business Add On)

Security Advisory

_{Related note}
2979062

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26820] Privilege escalation in SAP NetWeaver Application Server for Java (UDDI Server)

Security Advisory

_{Related note}
2973735

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/11/11

Description
[CVE-2020-26808] Code Injection in SAP AS ABAP and S/4 HANA (DMIS)

Security Advisory

_{Related note}
2982840

_CVSS
9.8

_{Affected system
type}
SAP Data Services

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
Multiple Vulnerabilities in SAP Data Services

Security Advisory

_{Related note}
2975170

_CVSS
7.5

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26810] Multiple Vulnerabilities in SAP Commerce Cloud (Accelerator Payment Mock)

Security Advisory

_{Related note}
2985094

_CVSS
4.3

_{Affected system
type}
Visual Enterprise

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26817] Improper input validation in Visual Enterprise Viewer

Security Advisory

_{Related note}
2944188

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-6316] Missing Authorization Check in SAP ERP and SAP S/4 HANA

Security Advisory

_{Related note}
2319577

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/10/27

Description
SQL Injection in SAF-T Portugal

Security Advisory

_{Related note}
2984627

_CVSS
8.6

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26815] Security Vulnerabilities in SAP Fiori Launchpad (NewsTile Application)

Security Advisory

_{Related note}
2947891

_CVSS
3.0

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
Missing Authorization check in Disbursement Read API used in Read Disbursement Webservice

Security Advisory

_{Related note}
2971954

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26818] Multiple vulnerabilities in SAP NetWeaver AS ABAP (Web Dynpro)

Security Advisory

_{Related note}
2971112

_CVSS
4.4

_{Affected system
type}
SAP ERP Client for E-Bilanz

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26807] Incorrect Default Permissions in SAP ERP Client for E-Bilanz 1.0

Security Advisory

_{Related note}
2975189

_CVSS
7.5

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[CVE-2020-26809] Information Disclosure in SAP Commerce Cloud

Security Advisory

_{Related note}
2985866

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
[Multiple CVE IDs] Missing Authentication Check in SAP Solution Manager (JAVA stack)

Security Advisory

_{Related note}
2824209

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2020-11

_{Released
on}
2020/11/10

Description
Clickjacking vulnerability in SAP Process Integration (Integration Builder Framework)

Security Advisory

_{Related note}
2956398

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6319] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java

Security Advisory

_{Related note}
2943844

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6308] Server-Side Request Forgery vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Services)

Security Advisory

_{Related note}
2606194

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/09/09

Description
Cross-Site Scripting (XSS) vulnerability in CRM Interaction Center

Security Advisory

_{Related note}
2965315

_CVSS
4.7

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6365] Reverse Tabnabbing vulnerability in SAP NetWeaver AS Java Start Page

Security Advisory

_{Related note}
2917381

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6272] Cross-Site Scripting (XSS) vulnerability in SAP Commerce Cloud

Security Advisory

_{Related note}
2972661

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6367] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Composite Application Framework

Security Advisory

_{Related note}
2883638

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Information Disclosure in Supplier Relationship Management

Security Advisory

_{Related note}
2955963

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Cross-Site Request Forgery (CSRF) in SAP Marketing

Security Advisory

_{Related note}
2960825

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6368] Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation

Security Advisory

_{Related note}
2973100

_CVSS
3.6

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Missing Authorization check in Manage Substitutions - Products and Manage Exclusions - Products

Security Advisory

_{Related note}
2965287

_CVSS
3.7

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6363] Insufficient Session Expiration in SAP Commerce Cloud

Security Advisory

_{Related note}
2969828

_CVSS
10.0

_{Affected system
type}
Solution Manager

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6364] OS Command Injection Vulnerability in CA Introscope Enterprise Manager (Affected Products: SAP Solution Manager and SAP Focused Run)

Security Advisory

_{Related note}
2873099

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
Missing Authorization check in EHS Task Definition attachments

Security Advisory

_{Related note}
2945581

_CVSS
4.7

_{Affected system
type}
SAP CRM UI

_Patchday
2020-10

_{Released
on}
2020/09/22

Description
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
2960329

_CVSS
4.4

_{Affected system
type}
SAP Enterprise Portal...

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6323] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (Fiori Framework Page)

Security Advisory

_{Related note}
2953212

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6362] Incorrect Authorization in SAP Banking Services

Security Advisory

_{Related note}
2973497

_CVSS
5.7

_{Affected system
type}
SAP 3D Visual Eneprise

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6315] Multiple Vulnerabilities in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
2963137

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6371] Information disclosure in SAP NetWeaver AS ABAP via the POWL Test Feeder endpoint

Security Advisory

_{Related note}
2971638

_CVSS
7.5

_{Affected system
type}
SAP Solution Manager...

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6369] Hard-coded Credentials in CA Introscope Enterprise Manager (Affected products: SAP Solution Manager and SAP Focused Run)

Security Advisory

_{Related note}
2969457

_CVSS
7.6

_{Affected system
type}
Java

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6366] Missing XML Validation in SAP NetWeaver (Compare Systems)

Security Advisory

_{Related note}
2939419

_CVSS
4.8

_{Affected system
type}
SAP NetWeaver...

_Patchday
2020-10

_{Released
on}
2020/10/13

Description
[CVE-2020-6370] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (DI Design Time Repository)

Security Advisory

_{Related note}
2531082

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-09

_{Released
on}
2019/03/12

Description
Switchable Authorization checks for RFC BCA_DIM_LOANS_APPLOG_UPDATE in Loans (FI-CAX-FS)

Security Advisory

_{Related note}
2930128

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6325] Multiple Vulnerabilities in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
2924859

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-09

_{Released
on}
2020/08/25

Description
Missing Authorization check in Discrete Industries and Mill Products

Security Advisory

_{Related note}
2865229

_CVSS
4.8

_{Affected system
type}
SAP UI5

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6283] Cross-Site Scripting (XSS) vulnerability in SAP Fiori(Launchpad)

Security Advisory

_{Related note}
2958563

_CVSS
9.1

_{Affected system
type}
ABAP

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6318] Code Injection vulnerability in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2953203

_CVSS
2.6

_{Affected system
type}
SAP Adaptive Server...

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6317] Information Disclosure in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2953112

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6326] Cross-Site Scripting (XSS) vulnerabilities in SAP NetWeaver AS Java

Security Advisory

_{Related note}
2951325

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6311] Improper Authorization Checks in Banking services from SAP Bank Analyzer and SAP S/4HANA Financial Products

Security Advisory

_{Related note}
2948239

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6324] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Test Application)

Security Advisory

_{Related note}
2934451

_CVSS
6.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6302] Session Fixation in SAP Commerce

Security Advisory

_{Related note}
2960815

_CVSS
4.3

_{Affected system
type}
SAP 3D Visual Eneprise

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[Multiple CVEs] Improper Input Validation in SAP 3D Visual Enterprise Viewer

Security Advisory

_{Related note}
2961991

_CVSS
9.6

_{Affected system
type}
SAP Marketing

_Patchday
2020-09

_{Released
on}
2020/09/08

Description
[CVE-2020-6320] Improper Access Control in SAP Marketing (Mobile Channel Servlet)

Security Advisory

_{Related note}
2921615

_CVSS
5.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
BI Platform stores SAP BW Authentication Password as clear text

Security Advisory

_{Related note}
2949196

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6301] Missing Authorization check in SAP ERP (HCM Travel Management)

Security Advisory

_{Related note}
2948317

_CVSS
6.1

_{Affected system
type}
SAP Commerce

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
Vulnerabilities in open source libraries used in SAP Commerce

Security Advisory

_{Related note}
2928635

_CVSS
9.0

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6284] Cross-Site Scripting (XSS) in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2927956

_CVSS
8.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6294] Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
2941315

_CVSS
7.5

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6309] Missing Authentication check in SAP NetWeaver AS JAVA

Security Advisory

_{Related note}
2944988

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6310] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2938162

_CVSS
7.3

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6293] Unrestricted File Upload in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2885671

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6273] Missing Authorization check in SAP S/4 HANA (Fiori UI for General Ledger Accounting)

Security Advisory

_{Related note}
2754546

_CVSS
5.0

_{Affected system
type}
Lumira Designer

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
Potential information disclosure in Lumira Designer

Security Advisory

_{Related note}
2939685

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6298] Missing Authorization check in SAP Banking Services (Generic Market Data)

Security Advisory

_{Related note}
2756551

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
Missing Authorization check in TSW Supply Chain Visualization

Security Advisory

_{Related note}
2925827

_CVSS
4.8

_{Affected system
type}
BI/BO platform

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6300] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Central Management Console)

Security Advisory

_{Related note}
2941667

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6296] Code Injection Vulnerability in SAP NetWeaver (ABAP) and ABAP Platform

Security Advisory

_{Related note}
2941332

_CVSS
7.0

_{Affected system
type}
SAP Adaptive Server...

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6295] Information Disclosure in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2941510

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6299] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2940823

_CVSS
6.3

_{Affected system
type}
SAP Data Hub

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
[CVE-2020-6297] Information Disclosure in SAP Data Intelligence

Security Advisory

_{Related note}
2593479

_CVSS
3.9

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2018/06/15

Description
Checking server certificates and host name of managed systems

Security Advisory

_{Related note}
2941170

_CVSS
6.1

_{Affected system
type}
SAPGUI / Frontend

_Patchday
2020-08

_{Released
on}
2020/08/11

Description
Cross-Site Scripting (XSS) vulnerabilities in modified jQuery bundled with SAPUI5

Security Advisory

_{Related note}
2896025

_CVSS
5.8

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6282] Server-Side Request Forgery in SAP NetWeaver AS JAVA (IIOP service)

Security Advisory

_{Related note}
2927373

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6280] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2537961

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Switchable Authorization checks for RFC in MM-PUR-GF

Security Advisory

_{Related note}
2603398

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing authorization check in Allocation Management

Security Advisory

_{Related note}
2486446

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization check in Pricat Inbound and Pricat Outbound

Security Advisory

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)

Security Advisory

_{Related note}
2541823

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/09

Description
Switchable authorization checks for RFC in SAP CRM (external billing)

Security Advisory

_{Related note}
2091403

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2015/08/11

Description
Directory traversal in BC-MID-ICF

Security Advisory

_{Related note}
2847817

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization check in Travel Management

Security Advisory

_{Related note}
2932473

_CVSS
7.7

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6285] Information Disclosure in SAP NetWeaver (XMLToolkit for Java)

Security Advisory

_{Related note}
2917743

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6281] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(BI Launch pad)

Security Advisory

_{Related note}
2912708

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6278] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)

Security Advisory

_{Related note}
2874738

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
Missing Authorization Check in S4 ACR Brazil Option

Security Advisory

_{Related note}
2758000

_CVSS
6.3

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6267] Multiple vulnerabilities in SAP Disclosure Management

Security Advisory

_{Related note}
2849967

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

Description
[CVE-2020-6276] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Bipodata)

Security Advisory

_{Related note}
2916562

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6270] Missing Authorization check in SAP Netweaver AS ABAP (Banking Services)

Security Advisory

_{Related note}
2933282

_CVSS
8.1

_{Affected system
type}
SAP Success Factors

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6279] Missing Authorization Check in SAP SuccessFactors Recruiting

Security Advisory

_{Related note}
2912939

_CVSS
7.6

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6275] Server Side Request Forgery vulnerability in SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
2878568

_CVSS
6.9

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6263] Authentication Bypass in Standalone Clients connecting to SAP NetWeaver AS Java via P4 Protocol

Security Advisory

_{Related note}
2931391

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6271] Missing XML Validation in SAP Solution Manager (Problem Context Manager)

Security Advisory

_{Related note}
2928570

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Ghostcat' Apache Tomcat AJP Vulnerability in SAP Liquidity Management for Banking

Security Advisory

_{Related note}
2923035

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
2906996

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6268] Missing authorization check in SAP ERP (Statutory Reporting for Insurance Companies)

Security Advisory

_{Related note}
2906366

_CVSS
8.6

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6264] Information Disclosure in SAP Commerce

Security Advisory

_{Related note}
2905836

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6269] Information Disclosure in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
2915126

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6260] Incomplete XML Validation in SAP Solution Manager (Trace Analysis)

Security Advisory

_{Related note}
2911704

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6266] URL redirection in SAP Fiori for SAP S/4HANA

Security Advisory

_{Related note}
2911687

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6266] URL redirection in SAP Fiori for SAP S/4HANA

Security Advisory

_{Related note}
2911267

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Update 1 to Security Note 2752614 - [CVE-2019-0319] Content Injection Vulnerability in SAP Gateway

Security Advisory

_{Related note}
2908382

_CVSS
4.4

_{Affected system
type}
SAP Business One

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6239] Information Disclosure in SAP Business One (Backup Service)

Security Advisory

_{Related note}
2540180

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Switchable Authorization checks for RFC in Environment, Health & Safety

Security Advisory

_{Related note}
2918924

_CVSS
9.8

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6265] Use of Hard-coded Credentials in SAP Commerce and SAP Commerce Datahub

Security Advisory

_{Related note}
2918762

_CVSS
6.5

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
Multiple vulnerabilities in Adobe LiveCycle Designer 11.0

Security Advisory

_{Related note}
2878935

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

Description
[CVE-2020-6246] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP ( Business Server Pages Test Application SBSPEXT_TABLE)

Security Advisory

_{Related note}
2747062

_CVSS
5.0

_{Affected system
type}
ABAP

_Patchday
2020-05

_{Released
on}
2020/05/12

Description
This note has been re-released without changes. - Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dynpro ABAP

Security Advisory

_{Related note}
2913293

_CVSS
6.1

_{Affected system
type}
SAP Enterprise Threat...

_Patchday
2020-05

_{Released
on}
2020/05/12

Description
[CVE-2020-6254] Cross-Site Scripting (XSS) vulnerability in SAP Enterprise Threat Detection

Security Advisory

Notifications