Solution Manager (Sap) - vulnerabilities (CVEs)

33 CVEs, 0 in the last 30 days, 23 known versions, newest CVE from 2023-12-12. Vendor: Sap.

CVEs of Solution Manager

CVE-2023-49587 - CVSS 6.4 (medium), 2023-12-12: SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or…
CVE-2023-36921 - CVSS 7.2 (high), 2023-07-11: SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to…
CVE-2023-36925 - CVSS 7.2 (high), 2023-07-11: SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the…
CVE-2023-27893 - CVSS 8.8 (high), 2023-03-14: An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed…
CVE-2023-23855 - CVSS 6.5 (medium), 2023-02-14: SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful…
CVE-2023-23852 - CVSS 6.1 (medium), 2023-02-14: SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)…
CVE-2023-0025 - CVSS 6.5 (medium), 2023-02-14: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user,…
CVE-2023-0024 - CVSS 6.5 (medium), 2023-02-14: SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user,…
CVE-2022-41275 - CVSS 6.1 (medium), 2022-12-13: In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can…
CVE-2022-41261 - CVSS 6 (medium), 2022-12-12: SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which…
CVE-2022-22544 - CVSS 9.1 (critical), 2022-02-09: Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse…
CVE-2021-21483 - CVSS 8.2 (high), 2021-04-13: Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct…
CVE-2020-26830 - CVSS 8.1 (high), 2020-12-09: SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to…
CVE-2020-26837 - CVSS 9.1 (critical), 2020-12-09: SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing…
CVE-2020-26836 - CVSS 6.1 (medium), 2020-12-09: SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an…
CVE-2020-26822 - CVSS 10 (critical), 2020-11-10: SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the…
CVE-2020-26821 - CVSS 10 (critical), 2020-11-10: SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the…
CVE-2020-26824 - CVSS 10 (critical), 2020-11-10: SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the…
CVE-2020-26823 - CVSS 10 (critical), 2020-11-10: SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the…
CVE-2020-6369 - CVSS 7.5 (high), 2020-10-20: SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the…
CVE-2020-6261 - CVSS 5.3 (medium), 2020-07-01: SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The…
CVE-2020-6271 - CVSS 8.2 (high), 2020-06-10: SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of…
CVE-2020-6260 - CVSS 6.5 (medium), 2020-06-10: SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete…
CVE-2020-6235 - CVSS 8.6 (high), 2020-04-14: SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading…
CVE-2020-6207 - CVSS 10 (critical), 2020-03-10: SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service…
CVE-2020-6198 - CVSS 9.8 (critical), 2020-03-10: SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all…
CVE-2019-0307 - CVSS 2.4 (low), 2019-06-12: Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP…
CVE-2019-0291 - CVSS 5.5 (medium), 2019-05-14: Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.
CVE-2018-2405 - CVSS 5.4 (medium), 2018-04-10: SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to…
CVE-2018-2361 - CVSS 8.8 (high), 2018-01-09: In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for…
CVE-2016-10005 - CVSS 7.5 (high), 2016-12-19: Webdynpro in SAP Solman 7.1 through 7.31 allows remote attackers to obtain sensitive information via webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd…
CVE-2014-5175 - CVSS 7.5 (high), 2014-07-31: The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb…
CVE-2013-7363 - CVSS 7.5 (high), 2014-04-10: Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the…