GCVE - cpe:2.3:a:sap:powerdesigner:16.7:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sap:powerdesigner:16.7:*:*:*:*:*:*:*

part: a version: 16.7 update: *

Vendor	Sap (`dd5aa0c0-20b0-5c86-a937-aa29f1a33b77`)
Product	Powerdesigner (`29b1f6bf-157c-527d-9b64-d27657015a70`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-40621`	vulnerable	2026-06-08 06:11:04.002028	Code Injection vulnerability in SAP PowerDesigner Client MEDIUM (6.3) SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default. Published: 2023-09-12T02:10:22.051Z Updated: 2024-09-25T15:25:02.097Z Open on db.gcve.eu Reference links https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html https://me.sap.com/notes/3357163	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-40310`	vulnerable	2026-06-08 06:09:42.061696	Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import MEDIUM (6.5) SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client. Published: 2023-10-10T01:35:28.068Z Updated: 2024-09-18T19:07:54.006Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3357154 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37484`	vulnerable	2026-06-08 06:08:15.489881	Information Disclosure Vulnerabilities in SAP PowerDesigner MEDIUM (5.3) SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory. Published: 2023-08-08T00:40:36.427Z Updated: 2024-10-10T19:28:52.145Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3341460 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-37483`	vulnerable	2026-06-08 06:08:15.489482	Improper Access Control Vulnerabilities in SAP PowerDesigner CRITICAL (9.8) SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy. Published: 2023-08-08T00:39:33.487Z Updated: 2024-10-10T19:00:59.714Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3341460 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-36923`	vulnerable	2026-06-08 06:08:14.705834	Code Injection vulnerability in SAP PowerDesigner HIGH (7.8) SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application. Published: 2023-08-08T00:36:59.717Z Updated: 2024-10-10T19:03:13.309Z Open on db.gcve.eu Reference links https://me.sap.com/notes/3341599 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.