SAP SRM MDM Catalog Authentication Bypass Vulnerability

SAP SRM is a supplier relationship management solution from SAP, of which MDM Catalog is a component with catalog content management and purchasing catalog functionality. An authentication bypass vulnerability in SAP SRM MDM Catalog versions 3.73, 7.31, and 7.32, which originates from a failure o...

Cross site scripting

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs...

CVE-2018-2399

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs...

CVE-2018-2399

Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inputs...

Cross site scripting

SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2368

CVE-2018-2368 affects SAP NetWeaver System Landscape Directory (SLD) and LM-CORE versions 7.10, 7.20, 7.30, 7.31, 7.40, where functions that require user identity perform no authentication checks. The connected documents corroborate an authentication bypass vulnerability impacting SAP NetWeaver S...

CVE-2017-16678

Server Side Request Forgery SSRF vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application...

SAP Solman - user accounts disclosure CVE-2016-10005

Application: SAP Solman Versions Affected: SAP Solman 7.1-7.31 Vendor URL: SAP Bugs: Information Disclosure Reported: 12.07.2016 Vendor response: 13.07.2016 Date of Public Advisory: 13.09.2016 Reference: SAP Security Note 2344524 Author: Roman Bezhan ERPScan VULNERABILITY INFORMATION CVE-2016-100...

CVE-2015-1309

XML external entity vulnerability in the Extended Computer Aided Test Tool eCATT in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATTDISPLAYXMLSTRINGREMOTE, aka SAP Note 2016638...

Drupal 7.0 7.31 - Drupalgeddon SQL Injection (Admin Session)

Drupal 7.0 7.31 - Drupalgeddon SQL Injection Admin Session //· include 'common.inc'; include 'password.inc'; // set values $username = 'admin'; $url = isset$argv1?$argv1:''; $userid = isset$argv2?intval$argv2:1; if $url == '-h' echo "usage:\n"; echo $argv0.' $url $userid'."\n"; die; if empty$url ...

Drupal HTTP Parameter Key/Value SQL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Drupal HTTP Parameter Key/Value SQL Injection', 'Description' = %q This module exploits the Drupal HTTP Parameter Key/Value SQL...

Drupal 7.31 version of the explosion a serious SQL injection vulnerability-vulnerability warning-the black bar safety net

This morning a foreign security researchers on Twitter exposed a Drupal 7.31 version of the latestSQL injectionvulnerabilities and gives using a test of the EXP code, small local structures Drupal7. 3 1 environment, tested, found that the use of the code can be successfully executed and the...

SAP NetWeaver Portal XMLValidationComponent - XXE

Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal 7.31.201109172004 Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.02.2015 Reference: SAP Security Note 2093966 Authors: Vahagn Vardanyan...

CVE-2013-6815

CVE-2013-6815 affects SAP NetWeaver Application Server for ABAP (AS ABAP) versions 7.31 and earlier. The SHSTI_UPLOAD_XML function is vulnerable to a XML External Entity (XXE) issue that can allow remote attackers to cause a denial of service. Affected component: SHSTI_UPLOAD_XML in AS ABAP; root...

CVE-2013-6244

The Live Update webdynpro application webdynpro/dispatcher/sap.com/tcslmuilup/LUP in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an...

IBM Informix Dynamic Server存在多个漏洞

IBM Informix Dynamic Server是一款多线索数据库服务器。 IBM Informix Dynamic Server存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息或者以进程权限执行任意代码。 具体问题包括： -LOTOFILE、DBINFO、FILETOCLOB、getname、ifxfiletofile函数缓冲区溢出。 -在sysmaster中通过dbimp和dbexp过程执行任意命令。 -windows版本上超长用户名缓冲区溢出。 -通过SET DEBUG FILE执行任意命令。 -SET DEBUG FILE缓冲区溢出 -通过C code UDR提权...