Filtered by vendor Sap Se Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-42374 2 Sap, Sap Se 2 Bex Web Java Runtime Export Web Service, Bex Web Java Runtime Export Web Service 2024-09-16 8.2 High
BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (PDF creation) unavailable. This affects the confidentiality and availability of the application.
CVE-2024-41730 2 Sap, Sap Se 2 Business Objects Business Intelligence Platform, Sap Business Objects Business Intgelligence Platform 2024-09-12 9.8 Critical
In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availability.
CVE-2024-39592 2 Sap, Sap Se 3 S4core, S4coreop, Sap Pdce 2024-08-29 7.7 High
Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.
CVE-2024-28167 1 Sap Se 1 Sap Group Reporting Data Collection 2024-08-02 6.5 Medium
SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.