# Vulnerabilities published in 2019


- [CVE-2019-0350](https://insights.sbomify.com/CVE-2019-0350/): Denial of service in SAP HANA Database (high 7.5)
- [CVE-2019-0349](https://insights.sbomify.com/CVE-2019-0349/): Missing authorization in SAP Kernel (KERNEL) (high 7.2)
- [CVE-2019-0348](https://insights.sbomify.com/CVE-2019-0348/): Weak cryptography in SAP Business Objects Business Intelligence Platform (Web Intelligence) (medium 6.5)
- [CVE-2019-0346](https://insights.sbomify.com/CVE-2019-0346/): Information disclosure in SAP Business Objects Business Intelligence Platform (CMC) (medium 6.5)
- [CVE-2019-0345](https://insights.sbomify.com/CVE-2019-0345/): Server-side request forgery in SAP NetWeaver Application Server for Java (Administrator System Overview) (critical 9.8)
- [CVE-2019-0344](https://insights.sbomify.com/CVE-2019-0344/): SAP Commerce Cloud Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2019-0343](https://insights.sbomify.com/CVE-2019-0343/): Code injection in SAP Commerce Cloud (Mediaconversion Extension) (high 8.8)
- [CVE-2019-0341](https://insights.sbomify.com/CVE-2019-0341/): Misconfiguration in SAP Enable Now (high 8.8)
- [CVE-2019-0340](https://insights.sbomify.com/CVE-2019-0340/): XML external entity in SAP Enable Now (medium 5.4)
- [CVE-2019-0338](https://insights.sbomify.com/CVE-2019-0338/): Information disclosure in SAP Gateway (medium 5.3)
- [CVE-2019-0337](https://insights.sbomify.com/CVE-2019-0337/): Cross-site scripting in SAP NetWeaver Process Integration (Java Proxy Runtime) (medium 6.1)
- [CVE-2019-0335](https://insights.sbomify.com/CVE-2019-0335/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (CMC) (medium 6.1)
- [CVE-2019-0334](https://insights.sbomify.com/CVE-2019-0334/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (BI Workspace) (medium 5.4)
- [CVE-2019-0333](https://insights.sbomify.com/CVE-2019-0333/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) (medium 6.5)
- [CVE-2019-0332](https://insights.sbomify.com/CVE-2019-0332/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (Info View) (medium 6.1)
- [CVE-2019-0331](https://insights.sbomify.com/CVE-2019-0331/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (BI Workspace) (medium 5.3)
- [CVE-2019-0330](https://insights.sbomify.com/CVE-2019-0330/): Code injection in SAP Diagnostic Agent (LM-Service) (critical 9.1)
- [CVE-2019-0329](https://insights.sbomify.com/CVE-2019-0329/): Cross-site scripting in SAP Information Steward (medium 6.1)
- [CVE-2019-0328](https://insights.sbomify.com/CVE-2019-0328/): Command injection in SAP NetWeaver Process Integration ABAP tests (SAP Basis) (high 7.2)
- [CVE-2019-0327](https://insights.sbomify.com/CVE-2019-0327/): File upload in SAP NetWeaver for Java Application Server - Web Container (engineapi) (high 7.2)
- [CVE-2019-0326](https://insights.sbomify.com/CVE-2019-0326/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform - BI Workspace (Enterprise) (medium 6.1)
- [CVE-2019-0325](https://insights.sbomify.com/CVE-2019-0325/): Missing authorization in SAP ERP HCM (SAP HRCES) (medium 4.2)
- [CVE-2019-0322](https://insights.sbomify.com/CVE-2019-0322/): Denial of service in SAP Commerce Cloud (ex SAP Hybris Commerce) (HY COM) (high 7.5)
- [CVE-2019-0321](https://insights.sbomify.com/CVE-2019-0321/): Cross-site scripting in ABAP Server and ABAP Platform (SAP Basis) (medium 6.1)
- [CVE-2019-0319](https://insights.sbomify.com/CVE-2019-0319/): Other in SAP Gateway (high 7.5)
- [CVE-2019-0318](https://insights.sbomify.com/CVE-2019-0318/): Information disclosure in SAP NetWeaver Application Server for Java (Startup Framework) (medium 5.3)
- [CVE-2019-0316](https://insights.sbomify.com/CVE-2019-0316/): Cross-site scripting in SAP NetWeaver Process Integration(SAP XIESR) (medium 4.8)
- [CVE-2019-0315](https://insights.sbomify.com/CVE-2019-0315/): Information disclosure in SAP NetWeaver Process Integration(SAP XIESR) (high 7.5)
- [CVE-2019-0314](https://insights.sbomify.com/CVE-2019-0314/): Denial of service in SAP Inventory Manager (medium 5.5)
- [CVE-2019-0312](https://insights.sbomify.com/CVE-2019-0312/): Missing authorization in SAP NetWeaver Process Integration(SAP XIESR) (medium 5.3)
- [CVE-2019-0311](https://insights.sbomify.com/CVE-2019-0311/): Cross-site scripting in SAP R/3 Enterprise Application (medium 6.1)
- [CVE-2019-0308](https://insights.sbomify.com/CVE-2019-0308/): Cross-site scripting in SAP E-Commerce (Business-to-Consumer application) (medium 6.8)
- [CVE-2019-0307](https://insights.sbomify.com/CVE-2019-0307/): Information disclosure in SAP Solution Manager(Diagnostics Agent) (low 2.4)
- [CVE-2019-0306](https://insights.sbomify.com/CVE-2019-0306/): Information disclosure in SAP HANA Extended Application Services (advanced model) (medium 4.3)
- [CVE-2019-0305](https://insights.sbomify.com/CVE-2019-0305/): Other in SAP NetWeaver Process Integration(SAP XIESR and SAP XITOOL) (medium 4.3)
- [CVE-2019-0304](https://insights.sbomify.com/CVE-2019-0304/): Code injection in SAP NetWeaver AS ABAP Platform(KERNEL) (critical 9.8)
- [CVE-2019-0303](https://insights.sbomify.com/CVE-2019-0303/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (Administration Console) (medium 6.1)
- [CVE-2019-0301](https://insights.sbomify.com/CVE-2019-0301/): Privilege escalation in SAP Identity Management (REST Interface) (high 8.8)
- [CVE-2019-0298](https://insights.sbomify.com/CVE-2019-0298/): Cross-site scripting in SAP E-Commerce (SAP-CRMJAV, SAP-CRMWEB, SAP-SHRWEB, SAP-SHRJAV, SAP-CRMAPP, SAP-SHRAPP) (medium 6.1)
- [CVE-2019-0293](https://insights.sbomify.com/CVE-2019-0293/): Missing authorization in SAP Solution Manager system (ST-PI) (medium 6.5)
- [CVE-2019-0291](https://insights.sbomify.com/CVE-2019-0291/): Information disclosure in SAP Solution Manager (medium 5.5)
- [CVE-2019-0289](https://insights.sbomify.com/CVE-2019-0289/): Information disclosure in SAP BusinessObjects Business Intelligence platform (high 7.1)
- [CVE-2019-0287](https://insights.sbomify.com/CVE-2019-0287/): Information disclosure in SAP BusinessObjects Business Intelligence platform (Central Management Server) (high 7.6)
- [CVE-2019-0285](https://insights.sbomify.com/CVE-2019-0285/): Information disclosure in SAP Crystal Reports for Visual Studio (critical 9.8)
- [CVE-2019-0284](https://insights.sbomify.com/CVE-2019-0284/): XML external entity in SAP HANA (medium 6.0)
- [CVE-2019-0283](https://insights.sbomify.com/CVE-2019-0283/): Security feature bypass in SAP NetWeaver Process Integration (Adapter Engine) (high 7.1)
- [CVE-2019-0282](https://insights.sbomify.com/CVE-2019-0282/): Auth bypass in SAP NetWeaver Process Integration (Runtime Workbench) (medium 5.3)
- [CVE-2019-0281](https://insights.sbomify.com/CVE-2019-0281/): Cross-site scripting in OpenUI5 (medium 6.1)
- [CVE-2019-0280](https://insights.sbomify.com/CVE-2019-0280/): Missing authorization in SAP Enterprise Financial Services (S4CORE) (high 8.8)
- [CVE-2019-0279](https://insights.sbomify.com/CVE-2019-0279/): Missing authorization in SAP BASIS (high 8.8)
- [CVE-2019-0278](https://insights.sbomify.com/CVE-2019-0278/): Information disclosure in SAP NetWeaver Process Integration (Messaging System) (medium 4.3)
- [CVE-2019-0277](https://insights.sbomify.com/CVE-2019-0277/): XML external entity in SAP HANA Extended Application Services (medium 6.5)
- [CVE-2019-0276](https://insights.sbomify.com/CVE-2019-0276/): Missing authorization in Banking services from SAP 9.0 (FSAPPL) (high 8.8)
- [CVE-2019-0275](https://insights.sbomify.com/CVE-2019-0275/): Cross-site scripting in SAP NetWeaver Java Application Server (J2EE-APPS) (medium 5.4)
- [CVE-2019-0274](https://insights.sbomify.com/CVE-2019-0274/): Denial of service in SAP Mobile Platform SDK (high 7.5)
- [CVE-2019-0271](https://insights.sbomify.com/CVE-2019-0271/): XML external entity in ABAP Server (medium 6.5)
- [CVE-2019-0270](https://insights.sbomify.com/CVE-2019-0270/): Missing authorization in ABAP Platform & Server (KERNEL) (high 8.8)
- [CVE-2019-0269](https://insights.sbomify.com/CVE-2019-0269/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (BI Workspace) (medium 5.4)
- [CVE-2019-0268](https://insights.sbomify.com/CVE-2019-0268/): XML external entity in SAP BusinessObjects Business Intelligence Platform (CMC Module) (high 8.1)
- [CVE-2019-0267](https://insights.sbomify.com/CVE-2019-0267/): Cross-site request forgery in SAP Manufacturing Integration and Intelligence (high 8.8)
- [CVE-2019-0266](https://insights.sbomify.com/CVE-2019-0266/): Information disclosure in SAP HANA Extended Application Services, advanced model (XS advanced) (high 7.5)
- [CVE-2019-0265](https://insights.sbomify.com/CVE-2019-0265/): Denial of service in ABAP Platform (KERNEL) (medium 4.9)
- [CVE-2019-0262](https://insights.sbomify.com/CVE-2019-0262/): Cross-site scripting in SAP WebIntelligence BILaunchPad (Enterprise) (medium 5.4)
- [CVE-2019-0261](https://insights.sbomify.com/CVE-2019-0261/): Auth bypass in SAP HANA Extended Application Services (critical 9.8)
- [CVE-2019-0259](https://insights.sbomify.com/CVE-2019-0259/): File upload in SAP BusinessObjects Business Intelligence Platform Servers (Enterprise) (critical 9.8)
- [CVE-2019-0258](https://insights.sbomify.com/CVE-2019-0258/): Missing authorization in SAP Disclosure Management (high 8.8)
- [CVE-2019-0257](https://insights.sbomify.com/CVE-2019-0257/): Missing authorization in ABAP Platform(SAP Basis) (high 8.8)
- [CVE-2019-0256](https://insights.sbomify.com/CVE-2019-0256/): Information disclosure in SAP Business One Mobile Android App (medium 5.5)
- [CVE-2019-0255](https://insights.sbomify.com/CVE-2019-0255/): Privilege escalation in sap:advanced business application programming platform kernel (high 8.1)
- [CVE-2019-0254](https://insights.sbomify.com/CVE-2019-0254/): Cross-site scripting in SAP Disclosure Management (medium 5.4)
- [CVE-2019-0251](https://insights.sbomify.com/CVE-2019-0251/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (Fiori Launchpad) (medium 6.1)
- [CVE-2019-0249](https://insights.sbomify.com/CVE-2019-0249/): Information disclosure in SAP Landscape Management(VCM) (high 7.5)
- [CVE-2019-0248](https://insights.sbomify.com/CVE-2019-0248/): Information disclosure in SAP Gateway of ABAP Application Server(SAP BASIS) (medium 5.9)
- [CVE-2019-0247](https://insights.sbomify.com/CVE-2019-0247/): Code injection in SAP Cloud Connector (critical 9.8)
- [CVE-2019-0246](https://insights.sbomify.com/CVE-2019-0246/): Missing authorization in SAP Cloud Connector (critical 9.8)
- [CVE-2019-0245](https://insights.sbomify.com/CVE-2019-0245/): Cross-site scripting in SAP CRM WebClient UI (S4FND) (medium 5.4)
- [CVE-2019-0244](https://insights.sbomify.com/CVE-2019-0244/): Cross-site scripting in SAP CRM WebClient UI (S4FND) (medium 5.4)
- [CVE-2019-0243](https://insights.sbomify.com/CVE-2019-0243/): Missing authorization in SAP BW/4HANA (DW4CORE) (high 8.8)
- [CVE-2019-0241](https://insights.sbomify.com/CVE-2019-0241/): Denial of service in SAP Work and Inventory Manager (Agentry SDK) (high 7.5)
- [CVE-2019-0240](https://insights.sbomify.com/CVE-2019-0240/): Denial of service in SAP Business Objects Mobile for Android (high 7.5)
- [CVE-2019-0238](https://insights.sbomify.com/CVE-2019-0238/): Cross-site scripting in SAP Commerce (ex. SAP Hybris Commerce) (medium 6.1)
- [CVE-2019-0235](https://insights.sbomify.com/CVE-2019-0235/): Cross-site request forgery in Apache OFBiz (high 8.8)
- [CVE-2019-0234](https://insights.sbomify.com/CVE-2019-0234/): Cross-site scripting in Apache Roller (medium 6.1)
- [CVE-2019-0233](https://insights.sbomify.com/CVE-2019-0233/): Improper Preservation of Permissions in Apache Struts (high 7.5)
- [CVE-2019-0232](https://insights.sbomify.com/CVE-2019-0232/): Apache Tomcat OS Command Injection vulnerability (high 8.1)
- [CVE-2019-0231](https://insights.sbomify.com/CVE-2019-0231/): Apache MINA SSLFilter security Issue (high 7.5)
- [CVE-2019-0230](https://insights.sbomify.com/CVE-2019-0230/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts (critical 9.8)
- [CVE-2019-0229](https://insights.sbomify.com/CVE-2019-0229/): Apache Airflow vulnerable to CSRF Attacks (high 8.8)
- [CVE-2019-0228](https://insights.sbomify.com/CVE-2019-0228/): Vulnerability that affects org.apache.pdfbox:pdfbox (critical 9.8)
- [CVE-2019-0227](https://insights.sbomify.com/CVE-2019-0227/): Server Side Request Forgery in Apache Axis (high 7.5)
- [CVE-2019-0226](https://insights.sbomify.com/CVE-2019-0226/): Apache Karaf vulnerable to relative path traversal (medium 4.9)
- [CVE-2019-0225](https://insights.sbomify.com/CVE-2019-0225/): Improper Limitation of a Pathname ('Path Traversal') in org.apache.jspwiki:jspwiki-war (high 7.5)
- [CVE-2019-0224](https://insights.sbomify.com/CVE-2019-0224/): Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-main (medium 6.1)
- [CVE-2019-0223](https://insights.sbomify.com/CVE-2019-0223/): Security feature bypass in Apache Qpid Proton (high 7.4)
- [CVE-2019-0222](https://insights.sbomify.com/CVE-2019-0222/): Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client (high 7.5)
- [CVE-2019-0221](https://insights.sbomify.com/CVE-2019-0221/): Cross-site scripting in Apache Tomcat (medium 6.1)
- [CVE-2019-0220](https://insights.sbomify.com/CVE-2019-0220/): Security feature bypass in Apache HTTP Server (medium 5.3)
- [CVE-2019-0219](https://insights.sbomify.com/CVE-2019-0219/): Privilege Escalation in cordova-plugin-inappbrowser (critical 9.8)
- [CVE-2019-0218](https://insights.sbomify.com/CVE-2019-0218/): Cross-site scripting in Apache Pony Mail (incubating) (medium 6.1)
- [CVE-2019-0217](https://insights.sbomify.com/CVE-2019-0217/): Race condition in Apache HTTP Server (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2019/page/161/