[ERPSCAN-15-016] SAP NetWeaver – Hardcoded credentials

ERPSCAN Research Advisory ERPSCAN-15-016 SAP NetWeaver – Hardcoded credentials Application: SAP NetWeaver Versions Affected: SAP NetWeaver AS ABAP, probably others Vendor URL: http://SAP.com Bugs: Hardcoded credentials Sent: 06.03.2014 Reported: 07.03.2014 Vendor response: 07.03.2014 Date of Publ...

SAP NetWeaver AS LSCT1I13 ABAP Hardcoded Credentials

ERPSCAN Research Advisory ERPSCAN-15-016 SAP NetWeaver – Hardcoded credentials Application: SAP NetWeaver Versions Affected: SAP NetWeaver AS ABAP, probably others Vendor URL: http://SAP.com Bugs: Hardcoded credentials Sent: 06.03.2014 Reported: 07.03.2014 Vendor response: 07.03.2014 Date of Publ...

SAP NetWeaver AS FKCDBFTRACE ABAP Hardcoded Credentials

ERPSCAN Research Advisory ERPSCAN-15-015 SAP NetWeaver AS ABAP– Hardcoded Credentials Application: SAP NetWeaver Versions Affected: SAP NetWeaver AS ABAP, probably others Vendor URL: http://SAP.com Bugs: Hardcoded credentials Sent: 06.03.2014 Reported: 07.03.2014 Vendor response: 07.03.2014 Date ...

SAP NetWeaver 7.4 - XSS

Application: SAP NetWeaver J2EE Engine 7.40 Vendor URL: http://www.sap.com Bugs: XSS Reported: 13.07.2015 Vendor response: 24.07.2015 Date of Public Advisory: 09.09.2015 Reference: SAP Security Note 2176785 Authors: Roman Bezhan ERPScan VULNERABILITY INFORMATION Class: Cross-Site Scripting, XSS...

CVE-2015-4158

SAP ABAP & Java Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2121661...

Code injection

SAP ABAP & Java Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2121661...

CVE-2015-4158

Technical details about CVE-2015-4158 are not publicly available in the provided connected documents; monitoring for updates is advised.

Stack Buffer Overflow Vulnerability in Multiple SAP Products

SAP NetWeaver is an integrated service-oriented application platform that provides a development and runtime environment for SAP applications; ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language; and SAP .NET Connector is a connector betwe...

Denial of Service Vulnerability in Multiple SAP Products

SAP NetWeaver is an integrated service-oriented application platform that provides a development and runtime environment for SAP applications; ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language; and SAP .NET Connector is a connector produ...

SAP MII - Encryption Downgrade vulnerability

Application: SAP MII Vendor URL: http://www.sap.com Bugs: Cryptographic issues Reported: 05.09.2015 Vendor response: 06.09.2015 Date of Public Advisory: 20.11.2015 Reference: SAP Security Note 2240274 Author: Mathieu GELI ERPScan VULNERABILITY INFORMATION Class: Cryptographic issues Impact: readi...

SAP NetWeaver 7.4 - XXE

Application: SAP NetWeaver Portal 7.4 Vendor URL: http://www.sap.com Bugs: XML eXternal Entity Reported: 16.04.2015 Vendor response: 17.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Authors: Roman Bezhan ERPScan VULNERABILITY INFORMATION Class: XML External Enti...

SAP Afaria - Stored XSS

Application: SAP Afaria 7 Vendor URL: http://www.sap.com Bugs: XSS Reported: 18.02.2015 Vendor response: 18.02.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2152669 Authors: Dmitry Chastukhin ERPScan Vulnerability information Class: XML External Entity CWE-79 Impact: Store...

SAP NetWeaver AS ABAP XML External Entity Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications.SAP Netweaver AS ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language. An XML external...

CVE-2015-1311

The Extended Application Services XS in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2015-1309

XML external entity vulnerability in the Extended Computer Aided Test Tool eCATT in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATTDISPLAYXMLSTRINGREMOTE, aka SAP Note 2016638...

CVE-2015-1309

The CVE-2015-1309 entry describes an XML External Entity (XXE) vulnerability in SAP NetWeaver AS ABAP, affecting the Extended Computer Aided Test Tool (eCATT) in SAP NetWeaver AS ABAP 7.31 and earlier. The root cause is and was exposure to crafted XML requests that leverage ECATT_DISPLAY_XMLSTRIN...

CVE-2015-1311

The Extended Application Services XS in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2015-1311

CVE-2015-1311 affects SAP HANA Extended Application Services (XS). The XS component allows remote attackers to inject arbitrary ABAP code through unspecified vectors, per SAP Note 2098906 and corroborated by CNVD/NVD entries. This constitutes remote code/injection potential in SAP HANA XS, with n...

PT-2015-5201 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 7.31 and earlier Description: The issue allows remote attackers to access arbitrary files via a crafted XML request. This is related to the ECATT DISPLAY XMLSTRING REMOTE function. Recommendations: For SAP...

CVE-2014-9594

Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the ABAP VM, aka SAP Note 2059734...