Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

8 records in Sql Anywhere · all components

TI-2022-15977 CVE-2022-35299 · GHSA-cvhc-gp9g-22mj

Stack-based buffer overflow in SAP SQL Anywhere

Priority MEDIUM 45

SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a memory corruption, such as Stack-based buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01235 Published 2022-10-11 No fix listed CWE-121
TI-2023-16857 CVE-2023-33990 · GHSA-fj2m-7r3q-j27x

Denial of Service (DoS) vulnerability in SAP SQL Anywhere

Priority LOW 35

SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00159 Published 2023-07-11 No fix listed CWE-277
TI-2022-19767 CVE-2022-41259 · GHSA-w86f-xj88-2xxm

SQL injection in SAP SQL Anywhere

Priority LOW 30

SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use an ARRAY constructor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00854 Published 2022-11-08 No fix listed CWE-89
TI-2016-08372 CVE-2016-10310 · GHSA-9984-6h88-256r

Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17…

Priority LOW 26

Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated users to cause a denial of service (resource consumption and process crash) by send…

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02024 Published 2017-04-10 No fix listed CWE-119
TI-2019-00311 CVE-2019-0381 · GHSA-g6vv-79qp-w952

A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1…

Priority LOW 25

A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00309 Published 2019-10-08 Fixed in 16.1, 17.0 +2 CWE-552
Open these records in search →