We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.
We hope you enjoy using it!
This time we found critical correction advisiories. We count 13 and the highest CVSS score is 9.1.
Severity
SAP© Security advisories 13
System Types
Affected SAP© system types
Affected system
type
Java
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-47582] XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
Affected system
type
SAP Web Dispatcher
Patchday
2024-12
Released
on
2024/11/12
Description
[CVE-2024-47590] Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
Affected system
type
Java
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-47578] Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
Affected system
type
ABAP
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-54198] Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Affected system
type
BI/BO platform
Patchday
2024-12
Released
on
2024/12/10
Description
Update 1 to Security Note 3433545: [CVE-2024-42375] Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
Affected system
type
BI/BO platform
Patchday
2024-12
Released
on
2024/08/13
Description
[CVE-2024-42375] Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
Affected system
type
ABAP
Patchday
2024-12
Released
on
2024/11/12
Description
[CVE-2024-47586] NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
Affected system
type
SAP Product Lifecycle Costing
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-47576] DLL Hijacking vulnerability in SAP Product Lifecycle Costing
Affected system
type
SAP Commerce Cloud
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-47577] Information Disclosure vulnerability in SAP Commerce Cloud
Affected system
type
BI/BO platform
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-32732] Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform
Affected system
type
ABAP
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-47585] Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform
Affected system
type
Java
Patchday
2024-12
Released
on
2024/12/10
Description
[CVE-2024-54197] Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)
Affected system
type
ABAP
Patchday
2024-12
Released
on
2024/11/26
Description
[CVE-2024-47581] Missing Authorization check in SAP HCM (Approve Timesheets version 4)