Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

11 records in Sap Kernel · all components

TI-2017-12277 CVE-2017-16689 · GHSA-crwv-5x5f-fc2f

Improper authentication in SAP Trusted RFC connection

Priority MEDIUM 40

A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established to a different client…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01185 Published 2017-12-12 No fix listed CWE-287
TI-2018-01748 CVE-2018-2360 · GHSA-7jrj-4gj5-f734

Missing authentication in SAP Startup Service

Priority LOW 38

SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02506 Published 2018-01-09 No fix listed CWE-306
TI-2019-00299 CVE-2019-0365 · GHSA-3jfh-7px5-vr77

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22…

Priority LOW 36

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01405 Published 2019-09-10 Fixed in 7.21, 7.21EXT +8
TI-2014-07786 CVE-2014-9595 · GHSA-c2vh-54mm-f6jj

Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit…

Priority LOW 33

Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0237 Published 2015-01-15 No fix listed CWE-119
TI-2014-07785 CVE-2014-9594 · GHSA-p7jh-mfpj-r63m

Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit…

Priority LOW 33

Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0237 Published 2015-01-15 No fix listed CWE-119
TI-2019-00234 CVE-2019-0271 · GHSA-gxw2-45rm-hpm8

Improper input validation in SAP ABAP Server

Priority LOW 32

ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01435 Published 2019-03-12 No fix listed CWE-20
TI-2017-12269 CVE-2017-16679 · GHSA-757w-wphr-p72r

Open redirect in SAP Startup Service

Priority LOW 29

URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.52, that…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00867 Published 2017-12-12 No fix listed CWE-601
Open these records in search →