Rezultati pretraživanja za 'Od datuma: 13.10.2026.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-89124 | 4.3 | Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended author | 2026-10-13 01:16:49 | 2026-10-13 01:16:49 |
| CVE-2026-89122 | 6.1 | SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted applicat | 2026-10-13 01:16:49 | 2026-10-13 01:16:49 |
| CVE-2026-89121 | 4.7 | SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to mo | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89120 | 7.1 | A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89118 | 5.3 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89117 | 6.1 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft o | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89116 | 5.9 | The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installat | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89113 | 8.8 | SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Suc | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89112 | 6.5 | The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could poten | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89111 | 10.0 | The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client cr | 2026-10-13 01:16:47 | 2026-10-13 01:16:47 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/7
Zapisa po stranici: