SAP SE SAP Enable Now
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-36920 | WPB_MANAGER 1.0, WPB_MANAGER_CE 10 ; WPB_MANAGER_HANA 10 ; ENABLE_NOW_CONSUMP_DEL 1704 | Clickjacking vulnerability in SAP Enable Now | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-35297 | 10 | The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being | MEDIUM 5.4 | 0.6 % | ||
| CVE-2020-6197 | < before version 1908 | SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow at | LOW 3.8 | 0.6 % | ||
| CVE-2020-6178 | < before version 1911 | SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, l | MEDIUM 5.4 | 0.7 % | ||
| CVE-2019-0405 | before 1911 | SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of use | HIGH 7.5 | 1.1 % | ||
| CVE-2019-0404 | before 1911 | SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disc | HIGH 7.5 | 1.1 % | ||
| CVE-2019-0403 | before 1911 | SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to | CRITICAL 9.8 | 2.1 % | ||
| CVE-2019-0385 | < 1908 | SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabil | MEDIUM 6.5 | 0.5 % | ||
| CVE-2019-0340 | < 1902 | The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validati | MEDIUM 5.4 | 0.7 % | ||
| CVE-2019-0341 | < 1902 | The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context | HIGH 8.8 | 1.1 % |