CVE-2020-6319: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal...

PT-2020-19087

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server JAVA XML Forms versions 7.30, 7.31, 7.40, 7.50 Description The issue arises from insufficient encoding of user-controlled inputs, allowing an authenticated user with special roles to store malicious content. Wh...

CVE-2020-6313: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server JAVAXML Forms versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing...

SAP NetWeaver AS Java Command Execution Vulnerability

SAP Netweaver is the German SAP SAP company's set of service-oriented integration of the application platform, the platform mainly for SAP applications to provide a development environment. The platform mainly for SAP applications to provide a development and runtime environment.SAP NetWeaver...

SAP NetWeaver AS ABAP Business Server Cross-Site Scripting Vulnerability

SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP Business Server. The vulnerability stems from a lack of proper validation of client data by the...

CVE-2020-6202: Improper Input Validation

SAP NetWeaver Application Server Java User Management Engine, versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation...

PT-2020-19003

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java User Management Engine versions 7.10 through 7.50 Description The issue arises from insufficient validation of the LDAP data source configuration XML document accepted from an untrusted source, leading to...

CVE-2015-7968

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

CVE-2015-7968: Improper Restriction of XML External Entity Reference

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

PT-2020-7900

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server before Security Note 2183189 Description: The issue allows XXE attacks for local file inclusion via the "sap/bc/ui2/nwbc/nwbc ext2int/" URI. This can be exploited to access local files. Recommendations: For SA...

CVE-2019-0389: Undefined Security Weakness

An administrator of SAP NetWeaver Application Server Java J2EE-Framework, corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5, may change privileges for all or some functions in Java Server, and enable users to execute functions, they are not allowed to execute otherwise...

SAP Netweaver Application Server Java CVE-2019-0389 Remote Privilege Escalation Vulnerability

Description SAP Netweaver Application Server Java is prone to a remote privilege-escalation vulnerability. Remote attackers can exploit this issue to gain elevated privileges. Technologies Affected SAP Netweaver Application Server Java 7.1 SAP Netweaver Application Server Java 7.2 SAP Netweaver...

PT-2019-4464

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions prior to 7.1 SAP NetWeaver Application Server Java versions prior to 7.2 SAP NetWeaver Application Server Java versions prior to 7.3 SAP NetWeaver Application Server Java versions prior to 7.31 SA...

PT-2019-4337

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions prior to 7.10 SAP NetWeaver Application Server Java versions prior to 7.20 SAP NetWeaver Application Server Java versions prior to 7.30 SAP NetWeaver Application Server Java versions prior to 7.31...

CVE-2019-0355: Improper Control of Generation of Code

SAP NetWeaver Application Server Java Web Container, ENGINEAPI before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP-JEECOR before versions 6.40, 7.0, 7.01, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the...

CVE-2019-0345: Server-Side Request Forgery (SSRF)

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java Administrator System Overview, versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP...

PT-2019-4196

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java versions 7.30 through 7.50 Description A remote unauthenticated attacker can exploit a web service in the SAP NetWeaver Application Server for Java by sending a specially crafted XML file. This can tri...

CVE-2019-0318: Undefined Security Weakness

Under certain conditions SAP NetWeaver Application Server for Java Startup Framework, versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted...

PT-2019-4584

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java Startup Framework versions 7.21, 7.22, 7.45, 7.49, and 7.53 Description The issue is related to the lack of protection for internal data in the Startup Framework component of the SAP NetWeaver...

SAP NetWeaver Application Server for ABAP Cross-Site Scripting Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications. SAP NetWeaver Application Server AS for ABAP is an application server that runs in NetWeaver and is based on the ABAP Advanced Business Programmi...