Input validation

Due to insufficient input sanitization, SAP NetWeaver AS ABAP Business Server Pages - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to...

CVE-2023-24522

Due to insufficient input sanitization, SAP NetWeaver AS ABAP Business Server Pages - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to...

CVE-2023-24522

CVE-2023-24522 affects SAP NetWeaver AS ABAP (Business Server Pages) and versions 700, 701, 702, 731, 740. Root cause: insufficient input sanitization that allows an unauthenticated user to inject malicious code over the network to alter a user’s current session, potentially exposing data. Impact...

SAP NetWeaver AS 跨站脚本漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but is also the basic platform for SAP software. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP BSP Framework versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755,...

PT-2023-19670 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Business Server Pages versions 700, 701, 702, 731, 740 Description: The issue is caused by insufficient input sanitization, allowing an unauthenticated user to alter the current session of the user by injecting malicious...

SAP NetWeaver AS ABAP and AS Java Memory Corruption (3145702)

A memory corruption vulnerability exists in SAP NetWeaver AS ABAP and AS Java kernel versions 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, and 8.04 which may allow an unauthenticated attacker to steal authentication information of the user. Note that Nessus has not tested for this issue...

CVE-2021-38178

The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious...

CVE-2021-38178

CVE-2021-38178 affects SAP NetWeaver AS ABAP and ABAP Platform versions 700–756. The vulnerability allows a malicious user to transfer ABAP code artifacts or content by bypassing the established quality gates, enabling code to reach quality and production and potentially compromising confidential...

CVE-2021-33678

CVE-2021-33678 affects SAP NetWeaver AS ABAP (Reconciliation Framework) across multiple releases (700–75F). A high-privilege attacker can inject code executed by the application, potentially deleting data and causing DoS/unavailability. Affected component: Reconciliation Framework function module...

PT-2021-20256 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Reconciliation Framework versions 700 through 75F Description: A function module in the Reconciliation Framework of SAP NetWeaver AS ABAP allows a high-privileged attacker to inject code that can be executed by the...

Authorization

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRMRFCSUBMITREPORT which fails to validate authorization of an authenticated user thus allowing an unauthorized user to execute reports in SAP NetWeaver AB...

CVE-2021-33663

CVE-2021-33663 affects SAP NetWeaver AS ABAP (multiple KRNL/KERNEL versions up to 7.84). Root cause: improper restriction of I/O buffering in encrypted SMTP sessions, allowing an unauthenticated remote attacker to insert cleartext commands and partially impact integrity. Affected components inclu...

CVE-2021-27611

CVE-2021-27611 affects SAP NetWeaver AS ABAP versions 700, 701, 702, 730, 731. The vulnerability enables a high-privileged, local attacker to inject malicious code by executing an ABAP report on a local SAP system, with potential data access/overwrite and denial of service. Root cause cited acros...

SAP NetWeaver AS ABAP Denial of Service Vulnerability (CNVD-2021-29099)

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A denial of service vulnerability exists in SAP NetWeaver AS ABAP versions 731, 740, and 750. The vulnerability...

CVE-2021-27603

An RFC enabled function module SPIWAITMILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the...

CVE-2021-27603

The CVE-2021-27603 entry concerns SAP NetWeaver AS ABAP. It affects SAP NetWeaver AS ABAP versions 731, 740, and 750, where the RFC function module SPI_WAIT_MILLIS can be invoked to keep a work process busy, enabling an attacker to repeatedly call it and block all work processes, causing a Denial...

SAP NetWeaver AS Java and AS ABAP Multiple Vulnerabilities (Jan 2021)

The version of SAP NetWeaver AS Java or ABAP detected on the remote host is affected by multiple vulnerabilities, as follows: - SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data suc...

CVE-2021-21446

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service...

CVE-2021-21446

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service...

SAP AS ABAP and SAP S4 HANA Improper Authentication Vulnerabilities

SAP Netweaver is a service-oriented, integrated application platform from SAP, which provides a development and runtime environment for SAP applications. The platform mainly provides development and operation environment for SAP applications.ABAP is an application server running in NetWeaver and...