SAP Kernel vulnerabilities

11 CVEs affecting SAP Kernel, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-0365, published 2019-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2360, published 2018-01-09. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.
CVE-2014-9595, published 2015-01-15. Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days. Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via…
CVE-2014-9594, published 2015-01-15. Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days. Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via…
CVE-2017-5997, published 2017-02-15. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple msgserver/group?group= requests…
CVE-2009-4603, published 2010-01-12. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. Unspecified vulnerability in sapstartsrv.exe in the SAP Kernel 6.40, 7.00, 7.01, 7.10, 7.11, and 7.20, as used in SAP NetWeaver 7.x and SAP Web Application Server 6.x and 7.x, allows remote attackers…
CVE-2019-0271, published 2019-03-12. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE)…
CVE-2019-0365, published 2019-09-10. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21,…
CVE-2017-16689, published 2017-12-12. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49, can be established…
CVE-2018-2433, published 2018-07-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.53) allows an attacker to…
CVE-2018-2441, published 2018-08-14. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. Under certain conditions the SAP Change and Transport System (ABAP), SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL…

Latest

CVE-2017-16679, published 2017-12-12. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22,…