SAP Security Blog

Practical SAP security research from the RedRays team: monthly SAP Security Patch Day analysis, breakdowns of SAP Security Notes and CVEs, ABAP code security, SAP BTP and cloud security, and penetration testing insights.

CVE-2020-6196 Denial of service (DOS) in SAP BusinessObjects Mobile (MobileBIService), SAP security note 2826782

RedRays Team March 10, 2020

CVE-2020-6203 Path Manipulation in SAP NetWeaver UDDI Server(Services Registry), SAP security note 2806198

RedRays Team March 10, 2020

Missing Authorization check in SAP NetWeaver (ABAP Server), SAP security note 2822074

RedRays Team March 10, 2020

CVE-2020-6191 Missing Input Validation in SAP Landscape Management, SAP security note 2878030

RedRays Team February 11, 2020

CVE-2020-6193Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (Knowledge Management ICE Service), SAP security note 2873012

RedRays Team February 11, 2020

CVE-2020-6186 Denial of Service (DOS) Vulnerability in SAP Host Agent, SAP security note 2841053

RedRays Team February 11, 2020

CVE-2020-6190Information Disclosure in SAP NetWeaver AS Java (Heap Dump Application), SAP security note 2838835

RedRays Team February 11, 2020

CVE-2020-6183 Unprivileged Access to technical data using SAPOSCOL of SAP Host Agent, SAP security note 2836445

RedRays Team February 11, 2020

CVE-2020-6184 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver and SAP S/4HANA, SAP security note 2880869

RedRays Team February 11, 2020

CVE-2020-6181 HTTP Response Splitting vulnerability in SAP NetWeaver and ABAP Platform, SAP security note 2880744

RedRays Team February 11, 2020

CVE-2020-6188 Missing Authorization check in SAP ERP and S/4 HANA (VAT Pro-Rata reports), SAP security note 2857511

RedRays Team February 11, 2020

Missing authorization check in IS-B-BCA-AM, SAP security note 2057196

RedRays Team February 11, 2020