Information disclosure

SAP NetWeaver ABAP Server and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure...

CVE-2020-6280

SAP NetWeaver ABAP Server and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure...

CVE-2020-6280

SAP NetWeaver ABAP Server/ABAP Platform, versions 731, 740, 750, are affected by an information-disclosure vulnerability where an admin user can access restricted files. Root cause described as improper access control; no public exploit details in the provided documents. Workarounds exist: PR not...

Unspecified Vulnerability in SAP Netweaver AS ABAP

SAP Netweaver is a set of service-oriented integrated application platform from SAP, which provides a development and runtime environment for SAP applications. The platform provides a development and runtime environment for SAP applications, and ABAP is an application server that runs in NetWeave...

CVE-2020-6270

SAP NetWeaver AS ABAP Banking Services, versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user...

CVE-2020-6275

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce...

CVE-2020-6246

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

CVE-2020-6246

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

Authorization

SAP NetWeaver AS ABAP Banking Services, versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user...

Cross site scripting

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

CVE-2020-6246

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

Server side request forgery (ssrf)

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce...

CVE-2020-6275

Concrete details available: SAP NetWeaver AS ABAP (versions 700–754) is vulnerable to Server-Side Request Forgery via improper path names in import/export of sessions, allowing the web server to authenticate to a malicious server; NTLM exposure can compromise confidentiality, integrity, and avail...

CVE-2020-6270

CVE-2020-6270 affects SAP NetWeaver AS ABAP (Banking Services) across versions 710, 711, 740, 750, 751, 752, 75A–75E. Root cause is a missing authorization check for an authenticated user, enabling unauthorized changes to individual conditions and potentially leading to incorrect pricing. Exploit...

CVE-2020-6270

SAP NetWeaver AS ABAP Banking Services, versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user...

CVE-2020-6246

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTTABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

CVE-2020-6246

CVE-2020-6246 affects SAP NetWeaver AS ABAP Business Server Pages SBSPEXT_TABLE (versions 700–754). It is a reflected XSS due to insufficient encoding of user-controlled inputs in SBSPEXT_TABLE, as documented by SAP/Red Hat and NVD references. Impacts: low confidentiality and integrity (per CVSS ...

PT-2020-19065 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Banking Services versions 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E Description: The issue arises due to a missing authorization check, allowing an authenticated user to make unauthorized changes to individua...

CVE-2020-6262

Service Data Download in SAP Application Server ABAP ST-PI, before versions 2008146C, 20081620, 20081640, 20081700, 20081710, 740 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system...

CVE-2020-6262

Service Data Download in SAP Application Server ABAP ST-PI, before versions 2008146C, 20081620, 20081640, 20081700, 20081710, 740 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system...