CVE-2023-35873

The Runtime Workbench RWB of SAP NetWeaver Process Integration - version SAPXITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...

CVE-2023-35873 Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)

The Runtime Workbench RWB of SAP NetWeaver Process Integration - version SAPXITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...

CVE-2023-35872 Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)

The Message Display Tool MDT of SAP NetWeaver Process Integration - version SAPXIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...

CVE-2023-33985

SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting XSS vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information...

Cross site scripting

SAP NetWeaver Design Time Repository - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could...

CVE-2023-33985

CVE-2023-33985 affects SAP NetWeaver Enterprise Portal 7.50. The vulnerability is a reflected XSS caused by insufficient encoding of user-controlled inputs over the network, leading to a limited impact on confidentiality and integrity. Connected sources corroborate the affected product/version an...

CVE-2023-33984

SAP NetWeaver (Design Time Repository) v7.50 is affected. The issue arises from returning an unfavorable content type for certain versioned files, enabling an authorized attacker to create a file containing malicious content and share a link resulting in cross-site scripting (XSS). Public referen...

Design/Logic Flaw

In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on confidentiality and integrity...

CVE-2023-27268

SAP NetWeaver AS Java Object Analyzing Service - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify...

CVE-2023-27268

CVE-2023-27268 relates to SAP NetWeaver AS Java (Object Analyzing Service) v7.50, where missing authorization checks allow an unauthenticated attacker to attach to an open interface and use the Open Naming and Directory API to access server data, enabling privilege escalation without modifying da...

CVE-2023-26460

The CVE-2023-26460 entry concerns the Cache Management Service of SAP NetWeaver Application Server for Java, version 7.50. The underlying issue is that this component does not perform authentication for functionalities that require user identity, enabling potential unauthorized operations. Affect...

CVE-2023-23857

CVE-2023-23857 affects SAP NetWeaver AS for Java 7.50. The issue is an authentication gap allowing unauthenticated actors to attach to an open interface and use a naming/directory API to access services, potentially reading/modifying sensitive information and causing system unavailability. The pr...

PT-2023-19674 · Sap · Sap Netweaver Application Server Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java for Classload Service version 7.50 Description: The issue results in escalation of privileges due to the lack of authentication checks for functionalities that require user identity. This has a low impact...

PT-2023-21046 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java Object Analyzing Service version 7.50 Description: The issue allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service. This enables them to...

SAP NetWeaver AS Java Improper Access Control (3268093)

An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current...

CVE-2023-0017

CVE-2023-0017 affects SAP NetWeaver AS for Java 7.50. An unauthenticated attacker can exploit improper access control by attaching to an open interface and using an open naming/directory API to access services, enabling unauthorized operations and potentially full read/write access to user data a...

CVE-2022-41272

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search UDS of SAP NetWeaver Process Integration PI - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized...

Cross site scripting

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35298

Summary: CVE-2022-35298 affects SAP NetWeaver Enterprise Portal (KMC) 7.50. The vulnerability stems from insufficient encoding of user-controlled inputs in the KMC servlet, allowing Cross-Site Scripting. Affected component: SAP NetWeaver Enterprise Portal (KMC) servlet, version 7.50, running on t...

Cross site scripting

SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. This attack can be used to non-permanently deface or modify portal content. The execution of script content by a...