Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

12 records in Netweaver As Abap · all components

TI-2022-10648 CVE-2022-27668 · GHSA-9xfm-7rcv-qrx6

Incorrect authorization in SAP NetWeaver and ABAP Platform

Priority MEDIUM 46

Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02203 Published 2022-06-14 No fix listed CWE-863
TI-2019-00223 CVE-2019-0257 · GHSA-xg34-8qvc-j4hh

Missing authorization in SAP ABAP Platform

Priority MEDIUM 41

Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0139 Published 2019-02-15 Fixed in 7.30, 7.31 +1 CWE-862
TI-2021-09084 CVE-2021-27632 · GHSA-x6wm-3h8r-fcf5

NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +4 CWE-476
TI-2021-09083 CVE-2021-27631 · GHSA-9m82-2363-wc54

NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +4 CWE-476
TI-2021-09082 CVE-2021-27630 · GHSA-3vw8-44x3-wrr9

NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +4 CWE-476
TI-2021-09081 CVE-2021-27629 · GHSA-ghqc-2jjw-x2g3

Out-of-bounds read in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +4 CWE-125
TI-2021-09080 CVE-2021-27628 · GHSA-5f46-4729-jprm

Out-of-bounds write in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +8 CWE-787
TI-2021-09059 CVE-2021-27607 · GHSA-8442-3jhx-m6j3

NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +8 CWE-476
TI-2021-09058 CVE-2021-27606 · GHSA-pgjj-gq5v-p74w

Out-of-bounds read in SAP NetWeaver ABAP Server and ABAP Platform

Priority LOW 36

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01508 Published 2021-06-09 Fixed in 7.22EXT, 7.49 +4 CWE-125
TI-2019-00266 CVE-2019-0321 · GHSA-v6gj-m3g3-p36w

Cross-site scripting in SAP ABAP Server and ABAP Platform

Priority LOW 30

ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01337 Published 2019-07-10 Fixed in 7.31, 7.4 +1 CWE-79
Open these records in search →