Security Advisories for SAP©

No JavaScript!

It seems your browser does not support JavaScript or it was disable by purpose!
We use JavaScript to improve the user experience. Please consider enabling it for a better usability.

Security Advisories

We've created the first of its kind, ABEX ^{Security Platform} to prioritize SAP patches, updates and the remediation strategies essential for preventing the disruption of vital business systems. Our security advisories enable SAP users to understand the security and business implications of running SAP.

The user interface, is designed to be as intuitive as possible but we'd love to hear your feedback and opinions.
We hope you like it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 160 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 160

System Types

Affected SAP© system types

_{Related note}
2927956

_CVSS
8.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6294] Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
2940823

_CVSS
6.3

_{Affected system
type}
SAP Data Hub

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6297] Information Disclosure in SAP Data Intelligence

Security Advisory

_{Related note}
2928635

_CVSS
9.0

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6284] Cross-Site Scripting (XSS) in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2941510

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6299] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2941332

_CVSS
7.0

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6295] Information Disclosure in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2948317

_CVSS
6.1

_{Affected system
type}
SAP Commerce

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
Vulnerabilities in open source libraries used in SAP Commerce

Security Advisory

_{Related note}
2941170

_CVSS
6.1

_{Affected system
type}
SAPGUI / Frontend

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
Cross-Site Scripting (XSS) vulnerabilities in modified jQuery bundled with SAPUI5

Security Advisory

_{Related note}
2949196

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6301] Missing Authorization check in SAP ERP (HCM Travel Management)

Security Advisory

_{Related note}
2925827

_CVSS
4.8

_{Affected system
type}
BI/BO platform

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6300] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Central Management Console)

Security Advisory

_{Related note}
2941667

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6296] Code Injection Vulnerability in SAP NetWeaver (ABAP) and ABAP Platform

Security Advisory

_{Related note}
2756551

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
Missing Authorization check in TSW Supply Chain Visualization

Security Advisory

_{Related note}
2939685

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6298] Missing Authorization check in SAP Banking Services (Generic Market Data)

Security Advisory

_{Related note}
2754546

_CVSS
5.0

_{Affected system
type}
Lumira Designer

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
Potential information disclosure in Lumira Designer

Security Advisory

_{Related note}
2885671

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6273] Missing Authorization check in SAP S/4 HANA (Fiori UI for General Ledger Accounting)

Security Advisory

_{Related note}
2938162

_CVSS
7.3

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6293] Unrestricted File Upload in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2944988

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6310] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2921615

_CVSS
5.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
BI Platform stores SAP BW Authentication Password as clear text

Security Advisory

_{Related note}
2941315

_CVSS
7.5

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2020/08/11

_Description
[CVE-2020-6309] Missing Authentication check in SAP NetWeaver AS JAVA

Security Advisory

_{Related note}
2593479

_CVSS
3.9

_{Affected system
type}
Java

_Patchday
2020-08

_{Released
on}
2018/06/15

_Description
Checking server certificates and host name of managed systems

Security Advisory

_{Related note}
2603398

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
Missing authorization check in Allocation Management

Security Advisory

_{Related note}
2934135

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)

Security Advisory

_{Related note}
2758000

_CVSS
6.3

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6267] Multiple vulnerabilities in SAP Disclosure Management

Security Advisory

_{Related note}
2847817

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
Missing Authorization check in Travel Management

Security Advisory

_{Related note}
2896025

_CVSS
5.8

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6282] Server-Side Request Forgery in SAP NetWeaver AS JAVA (IIOP service)

Security Advisory

_{Related note}
2927373

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6280] Information Disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform

Security Advisory

_{Related note}
2486446

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
Missing Authorization check in Pricat Inbound and Pricat Outbound

Security Advisory

_{Related note}
2091403

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2015/08/11

_Description
Directory traversal in BC-MID-ICF

Security Advisory

_{Related note}
2537961

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
Switchable Authorization checks for RFC in MM-PUR-GF

Security Advisory

_{Related note}
2912708

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6278] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)

Security Advisory

_{Related note}
2917743

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6281] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(BI Launch pad)

Security Advisory

_{Related note}
2874738

_CVSS
3.8

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
Missing Authorization Check in S4 ACR Brazil Option

Security Advisory

_{Related note}
2932473

_CVSS
7.7

_{Affected system
type}
Java

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6285] Information Disclosure in SAP NetWeaver (XMLToolkit for Java)

Security Advisory

_{Related note}
2541823

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-07

_{Released
on}
2020/06/09

_Description
Switchable authorization checks for RFC in SAP CRM (external billing)

Security Advisory

_{Related note}
2849967

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-07

_{Released
on}
2020/07/14

_Description
[CVE-2020-6276] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Bipodata)

Security Advisory

_{Related note}
2918924

_CVSS
9.8

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6265] Use of Hard-coded Credentials in SAP Commerce and SAP Commerce Datahub

Security Advisory

_{Related note}
2918762

_CVSS
6.5

_{Affected system
type}
Adobe LiveCycle Designer

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
Multiple vulnerabilities in Adobe LiveCycle Designer 11.0

Security Advisory

_{Related note}
2923035

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Security Advisory

_{Related note}
2928570

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
Ghostcat' Apache Tomcat AJP Vulnerability in SAP Liquidity Management for Banking

Security Advisory

_{Related note}
2931391

_CVSS
8.2

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6271] Missing XML Validation in SAP Solution Manager (Problem Context Manager)

Security Advisory

_{Related note}
2912939

_CVSS
7.6

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6275] Server Side Request Forgery vulnerability in SAP NetWeaver AS ABAP

Security Advisory

_{Related note}
2878568

_CVSS
6.9

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6263] Authentication Bypass in Standalone Clients connecting to SAP NetWeaver AS Java via P4 Protocol

Security Advisory

_{Related note}
2916562

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6270] Missing Authorization check in SAP Netweaver AS ABAP (Banking Services)

Security Advisory

_{Related note}
2933282

_CVSS
8.1

_{Affected system
type}
SAP Success Factors

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6279] Missing Authorization Check in SAP SuccessFactors Recruiting

Security Advisory

_{Related note}
2878935

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6246] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP ( Business Server Pages Test Application SBSPEXT_TABLE)

Security Advisory

_{Related note}
2905836

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6269] Information Disclosure in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
2906366

_CVSS
8.6

_{Affected system
type}
SAP Cloud Commerce

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6264] Information Disclosure in SAP Commerce

Security Advisory

_{Related note}
2906996

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6268] Missing authorization check in SAP ERP (Statutory Reporting for Insurance Companies)

Security Advisory

_{Related note}
2908382

_CVSS
4.4

_{Affected system
type}
SAP Business One

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6239] Information Disclosure in SAP Business One (Backup Service)

Security Advisory

_{Related note}
2911267

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
Update 1 to Security Note 2752614 - [CVE-2019-0319] Content Injection Vulnerability in SAP Gateway

Security Advisory

_{Related note}
2911687

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6266] URL redirection in SAP Fiori for SAP S/4HANA

Security Advisory

_{Related note}
2911704

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6266] URL redirection in SAP Fiori for SAP S/4HANA

Security Advisory

_{Related note}
2915126

_CVSS
6.5

_{Affected system
type}
Java

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
[CVE-2020-6260] Incomplete XML Validation in SAP Solution Manager (Trace Analysis)

Security Advisory

_{Related note}
2540180

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-06

_{Released
on}
2020/06/09

_Description
Switchable Authorization checks for RFC in Environment, Health & Safety

Security Advisory

_{Related note}
2913293

_CVSS
6.1

_{Affected system
type}
SAP Enterprise Threat Detection

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6254] Cross-Site Scripting (XSS) vulnerability in SAP Enterprise Threat Detection

Security Advisory

_{Related note}
2917090

_CVSS
9.0

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6252] Information Disclosure in SAP Adaptive Server Enterprise (Cockpit)

Security Advisory

_{Related note}
2920548

_CVSS
6.5

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6259] Missing authorization check in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2917275

_CVSS
9.1

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6248] Code injection in SAP Adaptive Server Enterprise (Backup Server)

Security Advisory

_{Related note}
2835979

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6262] Code Injection vulnerability in Service Data Download

Security Advisory

_{Related note}
2915585

_CVSS
8.0

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6243] Code Injection in SAP Adaptive Server Enterprise (XP Server on Windows Platform)

Security Advisory

_{Related note}
2915429

_CVSS
4.3

_{Affected system
type}
SAP IDM

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6258] Missing Authorization check in SAP Identity Management

Security Advisory

_{Related note}
2916927

_CVSS
8.8

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6241] SQL Injection vulnerability in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2747062

_CVSS
5.0

_{Affected system
type}
ABAP

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
This note has been re-released without changes - Cross-Site Request Forgery (CSRF) vulnerability in SAP WebDynpro ABAP

Security Advisory

_{Related note}
2917022

_CVSS
6.8

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6250] Information Disclosure in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2917273

_CVSS
7.2

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2020-05

_{Released
on}
2020/05/12

_Description
[CVE-2020-6253] SQL Injection vulnerability in SAP Adaptive Server Enterprise (Web Services)

Security Advisory

_{Related note}
2906994

_CVSS
8.6

_{Affected system
type}
SAP Solution Manager

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6235] Missing authentication check in SAP Solution Manager (Diagnostics Agent )

Security Advisory

_{Related note}
2863731

_CVSS
9.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6219] Deserialization of Untrusted Data in SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer)

Security Advisory

_{Related note}
2864966

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6212] Missing Authorization Check in SAP ERP & S/4 HANA (Egypt localized Withholding Tax reports)

Security Advisory

_{Related note}
2863396

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6227] Remote unauthenticated log injection in SAP Business Objects Business Intelligence Platform (CMS / Auditing issues)

Security Advisory

_{Related note}
2866752

_CVSS
5.3

_{Affected system
type}
SAPGUI / Frontend

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6228] Missing Integrity Check in SAP BUSINESS CLIENT

Security Advisory

_{Related note}
2879132

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6226] Cross-Site Scripting (XSS) vulnerabilities in SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface)

Security Advisory

_{Related note}
2877226

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/03/12

_Description
Switchable Authorization checks in SAP Supplier Relationship Management

Security Advisory

_{Related note}
2872752

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6213]Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP(Business Server Pages Test Application SBSPEXT_PHTMLB)

Security Advisory

_{Related note}
2872782

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6215] URL Redirection vulnerability in SAP NetWeaver AS ABAP – Business Server Pages Test Application IT00

Security Advisory

_{Related note}
2876059

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6216] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BILaunchpad/Opendocument)

Security Advisory

_{Related note}
2878507

_CVSS
6.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6195] Multiple vulnerabilities in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
2888556

_CVSS
5.3

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6232] Missing Authorization check in SAP Commerce

Security Advisory

_{Related note}
2900374

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6229] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME)

Security Advisory

_{Related note}
2897612

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6214] Incorrect Authorization in SAP S/4HANA (Financial Products Subledger)

Security Advisory

_{Related note}
2904480

_CVSS
9.3

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6238] Missing XML Validation vulnerability in SAP Commerce

Security Advisory

_{Related note}
2900118

_CVSS
9.1

_{Affected system
type}
SAP Orient DB

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6230] Code Injection vulnerability in SAP OrientDB 3.0

Security Advisory

_{Related note}
2904796

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6233] Missing Authorization Check in SAP S/4 HANA (Financial Products Subledger and Banking Services)

Security Advisory

_{Related note}
2826528

_CVSS
6.2

_{Affected system
type}
Java

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6224] Information Disclosure in SAP NetWeaver Application Server Java (HTTP Service)

Security Advisory

_{Related note}
2902645

_CVSS
7.2

_{Affected system
type}
SAP Host Agent

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6234] Privilege Escalation in SAP Host Agent

Security Advisory

_{Related note}
2902456

_CVSS
7.2

_{Affected system
type}
SAP Landscape Management

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6236] Privilege Escalation in SAP Landscape Management (SAP Adaptive Extensions)

Security Advisory

_{Related note}
2898077

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6237] Information Disclosure in SAP Business Objects Business Intelligence Platform (dswsbobje Web Application)

Security Advisory

_{Related note}
2896682

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6225] Directory Traversal vulnerability in SAP NetWeaver (Knowledge Management)

Security Advisory

_{Related note}
2872545

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6217] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages Test Application IT05)

Security Advisory

_{Related note}
2880804

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2020-04

_{Released
on}
2020/04/14

_Description
[CVE-2020-6222] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Security Advisory

_{Related note}
2806198

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6203] Path Manipulation in SAP NetWeaver UDDI Server(Services Registry)

Security Advisory

_{Related note}
2660005

_CVSS
7.2

_{Affected system
type}
SAP MaxDB

_Patchday
2020-03

_{Released
on}
2018/08/14

_Description
[CVE-2018-2450] SQL Injection Vulnerability in SAP MaxDB/liveCache

Security Advisory

_{Related note}
2845377

_CVSS
9.8

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6198] Missing Authentication check in SAP Solution Manager (Diagnostics Agent)

Security Advisory

_{Related note}
2890213

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6207] Missing Authentication Check in SAP Solution Manager (User-Experience Monitoring)

Security Advisory

_{Related note}
2847787

_CVSS
5.5

_{Affected system
type}
Java

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6202] Missing XML Validation in SAP NetWeaver Application Server Java (User Management Engine)

Security Advisory

_{Related note}
2731871

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
Missing Authorization check in Commercial Project Management

Security Advisory

_{Related note}
2884910

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6205] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP Business Server Pages (Smart Forms)

Security Advisory

_{Related note}
2880664

_CVSS
5.4

_{Affected system
type}
SAP Enable Now

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6178] Insufficient session expiration in SAP Enable Now Manager

Security Advisory

_{Related note}
2871167

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6199] Missing Authorization check in SAP ERP and S/4 HANA (MENA Certificate Management)

Security Advisory

_{Related note}
2864462

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6210] Cross-Site Scripting (XSS) vulnerability in SAP Fiori Launchpad

Security Advisory

_{Related note}
1966029

_CVSS
7.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
Directory traversal in SAP Environment Health and Safety

Security Advisory

_{Related note}
2861301

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6208] Remote Code Execution in SAP Business Objects Business Intelligence Platform (Crystal Reports)

Security Advisory

_{Related note}
2876413

_CVSS
5.4

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6200] Cross-Site-Scripting in SAP Commerce Cloud (SmartEdit extension)

Security Advisory

_{Related note}
2876813

_CVSS
6.1

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6201] Cross-Site Scripting (XSS) vulnerability in SAP Commerce Cloud (testweb extension)

Security Advisory

_{Related note}
2892570

_CVSS
5.9

_{Affected system
type}
ABAP Development Tools

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
Missing XML Validation vulnerability in ABAP Development Tools

Security Advisory

_{Related note}
2859004

_CVSS
4.7

_{Affected system
type}
SAP CPI DS

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6206] Cross-Site Request Forgery in SAP Cloud Platform Integration for data services

Security Advisory

_{Related note}
2858044

_CVSS
7.5

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6209] Missing Authorization check in SAP Disclosure Management

Security Advisory

_{Related note}
2845363

_CVSS
3.8

_{Affected system
type}
SAP Enable Now

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6197] Insufficient session expiration in SAP Enable Now Manager

Security Advisory

_{Related note}
2841874

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6204] Missing Authorization check in SAP Treasury and Risk Management (Transaction Management)

Security Advisory

_{Related note}
2826782

_CVSS
7.5

_{Affected system
type}
BI/BO platform

_Patchday
2020-03

_{Released
on}
2020/03/10

_Description
[CVE-2020-6196] Denial of service (DOS) in SAP BusinessObjects Mobile (MobileBIService)

Security Advisory

_{Related note}
2838835

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6190]Information Disclosure in SAP NetWeaver AS Java (Heap Dump Application)

Security Advisory

_{Related note}
2880869

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6184 ]Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver and SAP S/4HANA

Security Advisory

_{Related note}
2857511

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6188] Missing Authorization check in SAP ERP and S/4 HANA (VAT Pro-Rata reports)

Security Advisory

_{Related note}
2836445

_CVSS
5.3

_{Affected system
type}
SAP Host Agent

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6183] Unprivileged Access to technical data using SAPOSCOL of SAP Host Agent

Security Advisory

_{Related note}
2057196

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2014/09/17

_Description
Missing authorization check in IS-B-BCA-AM

Security Advisory

_{Related note}
2841053

_CVSS
7.5

_{Affected system
type}
SAP Host Agent

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6186] Denial of Service (DOS) Vulnerability in SAP Host Agent

Security Advisory

_{Related note}
2695776

_CVSS
7.4

_{Affected system
type}
SAP Mobile Platform

_Patchday
2020-02

_{Released
on}
2020/01/14

_Description
Missing Authorization Check in SAP Mobile Platform Native SDK, Android

Security Advisory

_{Related note}
2695210

_CVSS
5.3

_{Affected system
type}
BI/BO platform

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6189] Information Disclosure in SAP BusinessObjects BI Central Management Console

Security Advisory

_{Related note}
2877968

_CVSS
7.2

_{Affected system
type}
SAP Landscape Management

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6192] Missing Input Validation in SAP Landscape Management

Security Advisory

_{Related note}
2870067

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
Update 1 to Security Note 2736825 - [CVE-2019-0271] Denial of Service via XML External Entity (XXE) vulnerability in ABAP Server

Security Advisory

_{Related note}
2864415

_CVSS
4.9

_{Affected system
type}
Java

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6187]Missing XML Validation vulnerability in SAP NetWeaver(Guided Procedures)

Security Advisory

_{Related note}
2880744

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6181] HTTP Response Splitting vulnerability in SAP NetWeaver and ABAP Platform

Security Advisory

_{Related note}
2878030

_CVSS
7.2

_{Affected system
type}
SAP Landscape Management

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6191] Missing Input Validation in SAP Landscape Management

Security Advisory

_{Related note}
2873012

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6193]Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (Knowledge Management ICE Service)

Security Advisory

_{Related note}
2880993

_CVSS
4.3

_{Affected system
type}
SAP Mobile Platform

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
[CVE-2020-6177] Missing XML Validation vulnerability in SAP Mobile Platform

Security Advisory

_{Related note}
2622660

_CVSS
9.8

_{Affected system
type}
SAPGUI / Frontend

_Patchday
2020-02

_{Released
on}
2018/04/10

_Description
Security updates for the browser control Google Chromium delivered with SAP Business Client

Security Advisory

_{Related note}
2822074

_CVSS
6.6

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2020/01/14

_Description
Missing Authorization check in SAP NetWeaver (ABAP Server)

Security Advisory

_{Related note}
2736825

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2019/03/12

_Description
[CVE-2019-0271] Denial of Service via XML External Entity (XXE) vulnerability in ABAP Server

Security Advisory

_{Related note}
2688383

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-02

_{Released
on}
2020/02/11

_Description
Missing authorization check in Dangerous Goods Management of EHS Services in SCM

Security Advisory

_{Related note}
2865348

_CVSS
2.7

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
[CVE-2020-6306] Missing Authorization check in SAP Leasing

Security Advisory

_{Related note}
2495462

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
Switchable Authorization checks for RFC in SAP Leasing

Security Advisory

_{Related note}
2843016

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2019/11/12

_Description
[CVE-2019-0388] Content spoofing vulnerability in UI5 HTTP Handler

Security Advisory

_{Related note}
2142551

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2016/07/12

_Description
Whitelist service for Clickjacking Framing Protection in AS ABAP

Security Advisory

_{Related note}
2165892

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
Missing authorization check in Transaction Manager

Security Advisory

_{Related note}
2845401

_CVSS
5.4

_{Affected system
type}
Realtech

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
Missing Authorization check in Realtech RTCISM 100

Security Advisory

_{Related note}
2772325

_CVSS
5.4

_{Affected system
type}
SAP Disclosure Management

_Patchday
2020-01

_{Released
on}
2020/01/13

_Description
[CVE-2020-6303] Improper input validation in SAP Disclosure Management

Security Advisory

_{Related note}
2863743

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
[CVE-2020-6305] Cross-Site Scripting (XSS) vulnerability in Rest Adapter of SAP Process Integration

Security Advisory

_{Related note}
2863397

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
[CVE-2020-6307] Missing Authorization Check in Automated Note Search Tool (SAP_BASIS)

Security Advisory

_{Related note}
2848498

_CVSS
5.9

_{Affected system
type}
Kernel

_Patchday
2020-01

_{Released
on}
2020/01/14

_Description
[CVE-2020-6304] Denial of service (DOS) in SAP NetWeaver Internet Communication Manager

Security Advisory

_{Related note}
2871877

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2020-01

_{Released
on}
2019/12/24

_Description
Multiple security vulnerabilities in SAP EAM, add-on for MRO 4.0 by HCL for SAP S/4HANA 1809

Security Advisory

_{Related note}
2845780

_CVSS
6.7

_{Affected system
type}
SAP Adaptive Server Enterprise (ASE)

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
[CVE-2019-0402] Information Disclosure in SAP Adaptive Server Enterprise

Security Advisory

_{Related note}
2830578

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
[CVE-2019-0395] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad)

Security Advisory

_{Related note}
2814462

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2019-12

_{Released
on}
2019/11/26

_Description
Missing Authorization Check in S/4Hana ACR Brazil Option Features

Security Advisory

_{Related note}
2745211

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
Information Disclosure in PI Axis Adapter

Security Advisory

_{Related note}
2845183

_CVSS
5.3

_{Affected system
type}
SAP Enable Now

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
[CVE-2019-0405] Multiple Security vulnerabilities in SAP Enable Now release 1911

Security Advisory

_{Related note}
2504979

_CVSS
6.4

_{Affected system
type}
Java

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
Upgrade SSL support to TLSv1.2

Security Advisory

_{Related note}
2701027

_CVSS
4.3

_{Affected system
type}
BI/BO platform

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
[CVE-2019-0398] Cross-Site Request Forgery (CSRF) vulnerability in SAP BusinessObjects Business Intelligence Platform (Monitoring application)

Security Advisory

_{Related note}
2734675

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
Missing Authorization Check in SAP Cash Management

Security Advisory

_{Related note}
2803554

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2019-12

_{Released
on}
2019/12/10

_Description
[CVE-2019-0399] Potential Information Disclosure in SAP Portfolio and Project Management

Security Advisory

_{Related note}
2840520

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0386] - Missing authorization check in ERP Sales and SAP S/4HANA sales (SD-SLS)

Security Advisory

_{Related note}
2835226

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0391] Information Disclosure in SAP NetWeaver Application Server Java (eCATT service)

Security Advisory

_{Related note}
2819170

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0383] Missing Authorization check in SAP Treasury and Risk Management (Transaction Management)

Security Advisory

_{Related note}
2842034

_CVSS
5.0

_{Affected system
type}
SAP Data Hub

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0390] Information Disclosure in SAP Data Hub

Security Advisory

_{Related note}
2839864

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
Update 2 to Security Note 2808158: [CVE-2019-0330] OS Command Injection vulnerability in SAP Diagnostics Agent

Security Advisory

_{Related note}
2393937

_CVSS
7.1

_{Affected system
type}
ABAP

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
VMC Authority Check

Security Advisory

_{Related note}
2814007

_CVSS
7.1

_{Affected system
type}
BI/BO platform

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0396] Missing XML Validation vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)

Security Advisory

_{Related note}
2814357

_CVSS
5.9

_{Affected system
type}
Java

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0389] Privilege escalation in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
2816035

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0393] SQL injection vulnerability in SAP Quality Management

Security Advisory

_{Related note}
2817937

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0382] XSS vulnerabilty in SAP Business Objects BI Platform (Web Intelligence)

Security Advisory

_{Related note}
2828981

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0384] Missing Authorization check in SAP Treasury and Risk Management (Transaction Management)

Security Advisory

_{Related note}
2833771

_CVSS
6.5

_{Affected system
type}
SAP Enable Now

_Patchday
2019-11

_{Released
on}
2019/11/12

_Description
[CVE-2019-0385] Cross-Site Scripting (XSS) vulnerability in SAP Enable Now