Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

8 records in Landscape Management · all components

TI-2019-00226 CVE-2019-0261 · GHSA-wvqm-vf4g-854v

Missing authentication in SAP HANA Extended Application Services

Priority MEDIUM 48

Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03629 Published 2019-02-15 No fix listed CWE-306
TI-2020-05049 CVE-2020-6192 · GHSA-2524-6f4r-2jq9

Improper input validation in SAP Landscape Management

Priority LOW 35

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01718 Published 2020-02-12 No fix listed CWE-20
TI-2020-05048 CVE-2020-6191 · GHSA-6xf9-38qw-rvjg

Improper input validation in SAP Landscape Management

Priority LOW 35

SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01579 Published 2020-02-12 No fix listed CWE-20
TI-2020-05092 CVE-2020-6236 · GHSA-qrvg-vrjq-42gc

Improper privilege management in SAP Landscape Management

Priority LOW 34

SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remot…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01236 Published 2020-04-14 Fixed in 3.0, 1.0 CWE-269
TI-2019-00310 CVE-2019-0380 · GHSA-5q4m-vww4-2rhm

Sensitive information in log files in SAP Landscape Management enterprise edition

Priority LOW 24

Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00875 Published 2019-10-08 Fixed in 3.0 CWE-532
Open these records in search →