SAP

Records1968All Threatist records

Exploited (KEV)14In CISA KEV

CVSS critical221CVSS 9.0–10.0

CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV

TI-2025-27866 SAP NetWeaver Deserialization Vulnerability CRITICAL 98KEV 2025-05-15 TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability CRITICAL 100KEV 2025-04-29 TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability CRITICAL 90KEV 2025-03-19 TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2024-09-30 TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability CRITICAL 100KEV 2022-08-18 TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records

3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

8 records in Rfc Library · all components

TI-2007-01839 CVE-2007-1917 · GHSA-2qp9-qg33-hhf9

Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and…

MEDIUM 52

Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0671 Published 2007-04-10 No fix listed

TI-2007-01838 CVE-2007-1916 · GHSA-5w7j-x3jc-3r86

Buffer overflow in the RFC_START_GUI function in the SAP RFC Library 6.40 and 7.00 before…

MEDIUM 52

Buffer overflow in the RFC_START_GUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0671 Published 2007-04-10 No fix listed

TI-2007-01837 CVE-2007-1915 · GHSA-994f-m97v-7qwg

Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00…

MEDIUM 40

Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04406 Published 2007-04-10 No fix listed

TI-2015-02019 CVE-2015-2282 · GHSA-4mgc-gcxj-hf9r

Stack-based buffer overflow in the LZC decompression implementation…

LOW 39

Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java,…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03518 Published 2015-06-02 No fix listed CWE-119

TI-2007-01836 CVE-2007-1914 · GHSA-gr6x-4fcp-wfg7

The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211…

LOW 38

The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors, a different vu…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.01801 Published 2007-04-10 No fix listed

TI-2007-01840 CVE-2007-1918 · GHSA-vcj7-x5xm-h7mr

The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before…

LOW 28

The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server, which allows remote attackers to cause a denial of service (client…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0263 Published 2007-04-10 No fix listed

TI-2015-02015 CVE-2015-2278 · GHSA-w343-46q8-7x26

The LZH decompression implementation (CsObjectInt::BuildHufTree function in…

LOW 27

The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SD…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02131 Published 2015-06-02 No fix listed CWE-119

TI-2007-01835 CVE-2007-1913 · GHSA-rf6q-wrm8-hjq7

The TRUSTED_SYSTEM_SECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211…

LOW 27

The TRUSTED_SYSTEM_SECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vu…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02295 Published 2007-04-10 No fix listed

Open these records in search →

Critical	221
High	534
Medium	1145
Low	68
No CVSS	0