Overview 36 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
36matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
36
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
36
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
36
100.0%
split by
peak 9 / year
20144
Not applicable4
Low4
not blocked4
No public exploit4
20153
Not applicable3
Low3
not blocked3
No public exploit3
20161
Not applicable1
Low1
not blocked1
No public exploit1
20171
Not applicable1
Low1
not blocked1
No public exploit1
20181
Not applicable1
Low1
not blocked1
No public exploit1
20192
Not applicable2
Low2
not blocked2
No public exploit2
20205
Not applicable5
Low5
not blocked5
No public exploit5
20219
Not applicable9
Low9
not blocked9
No public exploit9
20222
Not applicable2
Low2
not blocked2
No public exploit2
20232
Not applicable2
Low2
not blocked2
No public exploit2
20242
Not applicable2
Low2
not blocked2
No public exploit2
20250
20264
Not applicable4
Low4
not blocked4
No public exploit4
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-66774 | Low | 2026-08-11 | Not applicable | No public exploit | SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation is highly complex, as it depends on conditions outside the attacker's control. This could result in a low impact on availability. There is no impact on confidentiality and integrity. |
| CVE-2026-58239 | Low | 2026-08-11 | Not applicable | No public exploit | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability. |
| CVE-2026-24320 | Low | 2026-02-10 | Not applicable | No public exploit | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability. |
| CVE-2026-23686 | Low | 2026-02-10 | Not applicable | No public exploit | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected. |
| CVE-2024-44114 | Low | 2024-09-10 | Not applicable | No public exploit | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application. |
| CVE-2024-41728 | Low | 2024-09-10 | Not applicable | No public exploit | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects. |
| CVE-2023-49578 | Low | 2023-12-12 | Not applicable | No public exploit | SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity of the application. |
| CVE-2023-32114 | Low | 2023-06-13 | Not applicable | No public exploit | SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application. |
| CVE-2022-29615 | Low | 2022-06-14 | Not applicable | No public exploit | SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x. |
| CVE-2022-27657 | Low | 2022-04-12 | Not applicable | No public exploit | A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run (Simple Diagnostics Agent 1.0) - version 1.0. |
| CVE-2021-42070 | Low | 2021-12-14 | Not applicable | No public exploit | When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application |
| CVE-2021-42069 | Low | 2021-12-14 | Not applicable | No public exploit | When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application |
| CVE-2021-42068 | Low | 2021-12-14 | Not applicable | No public exploit | When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2021-27596 | Low | 2021-03-22 | Not applicable | No public exploit | When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2021-27595 | Low | 2021-03-22 | Not applicable | No public exploit | When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2021-27594 | Low | 2021-03-22 | Not applicable | No public exploit | When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2021-27593 | Low | 2021-03-22 | Not applicable | No public exploit | When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2021-27584 | Low | 2021-03-09 | Not applicable | No public exploit | When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2021-21493 | Low | 2021-03-09 | Not applicable | No public exploit | When a user opens manipulated Graphics Interchange Format (.GIF) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application. |
| CVE-2020-6317 | Low | 2020-11-30 | Not applicable | No public exploit | In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears in the installation log files. This information although sensitive is of limited utility and cannot be used to further access, modify or render unavailable any other information in the cockpit or system. This affects SAP Adaptive Server Enterprise, Versions - 15.7, 16.0. |
| CVE-2020-26807 | Low | 2020-11-10 | Not applicable | No public exploit | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone to modify the files in the folder. |
| CVE-2020-6280 | Low | 2020-07-14 | Not applicable | No public exploit | SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure. |
| CVE-2020-6197 | Low | 2020-03-10 | Not applicable | No public exploit | SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for instance, to still download the portables. |
| CVE-2020-6306 | Low | 2020-01-14 | Not applicable | No public exploit | Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). |
| CVE-2019-0353 | Low | 2019-09-10 | Not applicable | No public exploit | Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted. |
| CVE-2019-0307 | Low | 2019-06-12 | Not applicable | No public exploit | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained. |
| CVE-2018-2497 | Low | 2018-12-11 | Not applicable | No public exploit | The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT. |
| CVE-2017-9843 | Low | 2017-07-12 | Not applicable | No public exploit | SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841. |
| CVE-2016-7437 | Low | 2016-10-13 | Not applicable | No public exploit | SAP Netweaver 7.40 improperly logs (1) DUI and (2) DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC function callbacks by leveraging filtering of non-critical events in audit analysis reports, aka SAP Security Note 2252312. |
| CVE-2015-7728 | Low | 2015-10-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898. |
| CVE-2015-7726 | Low | 2015-10-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898. |
| CVE-2015-3978 | Low | 2015-05-12 | Not applicable | No public exploit | SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830. |
| CVE-2014-8312 | Low | 2014-10-16 | Not applicable | No public exploit | Business Warehouse (BW) in SAP Netweaver AS ABAP 7.31 allows remote authenticated users to obtain sensitive information via a request to the RSDU_CCMS_GET_PROFILE_PARAM RFC function. |
| CVE-2014-8311 | Low | 2014-10-16 | Not applicable | No public exploit | SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information via an InfoStore query to a CORBA listener. |
| CVE-2014-5174 | Low | 2014-07-31 | Not applicable | No public exploit | The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors. |
| CVE-2014-5171 | Low | 2014-07-31 | Not applicable | No public exploit | SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network. |