CVE-2021-33664: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP Applications based on Web Dynpro ABAP, versions - SAPUI - 750,752,753,754,755, SAPBASIS - 702, 731 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2021-27621: Undefined Security Weakness

Information Disclosure vulnerability in UserAdmin application in SAP NetWeaver Application Server for Java, versions - 7.11,7.20,7.30,7.31,7.40 and 7.50 allows attackers to access restricted information by entering malicious server name...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server, which can be exploited by an attacker to launch a cross-site scripting attack...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server, which can be exploited by an attacker to launch a cross-site scripting attack...

CVE-2021-21492

SAP NetWeaver Application Server JavaHTTP Service, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled...

PT-2021-14551

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java affected versions not specified Description The issue allows an unauthorized attacker to trick an administrator into invoking telnet commands on the SAP NetWeaver Application Server for Java, potential...

PT-2021-14558

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java HTTP Service versions 7.10 through 7.50 Description The issue arises from insufficient validation of logon groups in URLs, leading to a content spoofing issue when directory listing is enabled...

CVE-2021-21485: Undefined Security Weakness

An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user...

CVE-2021-21492: Authentication Bypass by Spoofing

SAP NetWeaver Application Server JavaHTTP Service, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled...

SAP NetWeaver AS JAVA Missing Authorization Check (3022422)

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

PT-2021-14557

Name of the Vulnerable Software and Affected Versions SAP Netweaver Application Server Java Applications based on WebDynpro Java versions 7.00 through 7.50 Description The issue allows an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. This can potentiall...

CVE-2021-21491: URL Redirection to Untrusted Site

SAP Netweaver Application Server Java Applications based on WebDynpro Java versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities...

PT-2020-19093

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 Description The issue allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols, which are otherwis...

CVE-2020-6319: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal...

CVE-2020-6371: Undefined Security Weakness

User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP POWL test application versions - 710, 711, 730, 731, 740, 750, leading to Information Disclosure...

PT-2020-19087

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server JAVA XML Forms versions 7.30, 7.31, 7.40, 7.50 Description The issue arises from insufficient encoding of user-controlled inputs, allowing an authenticated user with special roles to store malicious content. Wh...

CVE-2020-6313: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server JAVAXML Forms versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing...

SAP NetWeaver AS ABAP Business Server Cross-Site Scripting Vulnerability

SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP Business Server. The vulnerability stems from a lack of proper validation of client data by the...

PT-2020-19003

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java User Management Engine versions 7.10 through 7.50 Description The issue arises from insufficient validation of the LDAP data source configuration XML document accepted from an untrusted source, leading to...

CVE-2020-6202: Improper Input Validation

SAP NetWeaver Application Server Java User Management Engine, versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation...