SAP NetWeaver Business Client vulnerabilities

2 CVEs affecting SAP NetWeaver Business Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-4160, published 2014-06-13.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2010-4556, published 2010-12-17. High severity, CVSS 9.3. EPSS: 6.1% chance of exploitation in the next 30 days. Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2)…
• CVE-2014-4160, published 2014-06-13. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or…