| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-89118 | 5.3 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89117 | 6.1 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft o | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89116 | 5.9 | The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installat | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89113 | 8.8 | SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Suc | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89112 | 6.5 | The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could poten | 2026-10-13 01:16:48 | 2026-10-13 01:16:48 |
| CVE-2026-89111 | 10.0 | The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client cr | 2026-10-13 01:16:47 | 2026-10-13 01:16:47 |
| CVE-2026-89110 | 9.9 | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection conf | 2026-10-13 01:16:47 | 2026-10-13 01:16:47 |
| CVE-2026-89108 | 9.1 | SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an | 2026-10-13 01:16:47 | 2026-10-13 01:16:47 |
| CVE-2026-89107 | 9.9 | SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could s | 2026-10-13 01:16:47 | 2026-10-13 01:16:47 |
| CVE-2026-89106 | 4.4 | SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentia | 2026-10-13 01:16:47 | 2026-10-13 01:16:47 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: