SAP Mobile Platform vulnerabilities

8 CVEs affecting SAP Mobile Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-7731, published 2021-08-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5068, published 2015-06-24. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security…
CVE-2018-2459, published 2018-09-11. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a different…
CVE-2015-6664, published 2015-08-24. Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact…
CVE-2015-2813, published 2015-04-01. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
CVE-2015-8600, published 2015-12-17. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown…
CVE-2015-2818, published 2015-04-01. Medium severity, CVSS 5.0. EPSS: 1.1% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125513.
CVE-2020-6177, published 2020-02-12. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not…
CVE-2015-7731, published 2021-08-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP Security Note 2094830.