SAP Financial Consolidation – version 1010,?does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVE-2022-31594
A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system.
CVE-2022-31593
SAP Business One client – version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVE-2022-31592
The application SAP Enterprise Extension Defense Forces & Public Security – versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality.
CVE-2022-31591
SAP BusinessObjects BW Publisher Service – versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service
CVE-2022-31590
SAP PowerDesigner Proxy – version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the application during application start up or reboot, potentially compromising Confidentiality, Integrity and Availability of the system.