CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35294

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing...

CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

Cross site scripting

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing...

Cross site scripting

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35298

Summary: CVE-2022-35298 affects SAP NetWeaver Enterprise Portal (KMC) 7.50. The vulnerability stems from insufficient encoding of user-controlled inputs in the KMC servlet, allowing Cross-Site Scripting. Affected component: SAP NetWeaver Enterprise Portal (KMC) servlet, version 7.50, running on t...

CVE-2022-35298

SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...

CVE-2022-35294

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing...

CVE-2022-35294

CVE-2022-35294 describes a stored XSS vulnerability in SAP NetWeaver Application Server ABAP. An attacker with basic business user privileges can craft and upload a malicious file, which is downloaded and viewed by other users, allowing information disclosure (including potential credential theft...

SAP NetWeaver Enterprise Portal 跨站脚本漏洞

SAP NetWeaver Enterprise Portal is a web front-end component for SAP NetWeaver from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal KMC version 7.50, which stems from insufficient control over user input, resulting in a cross-site scripting vulnerabilit...

PT-2022-22693 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an attacker with basic business user privileges to craft and upload a malicious file, which is then downloaded and viewed by other users,...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server ABAP. An attacker could exploit the vulnerability to create and upload malicious files, resulting in a stored cross-site scripting attack...

PT-2022-22697 · Sap · Sap Netweaver Enterprise Portal

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Enterprise Portal KMC version 7.50 Description: The issue arises from insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting vulnerability. The KMC servlet is vulnerable to XSS attacks, which could...

Exploit for Path Traversal in Sap Netweaver

CVE-2021-38163 CVE-2021-38163 - exploit for SAP Netveawer SAP...

SAP NetWeaver AS ABAP Missing Authorization (3165801)

A missing authorization vulnerability exists in SAP NetWeaver Application Server ABAP. The application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Note that Nessus has not tested for this issue but has instead relied only on th...

SAP NetWeaver AS ABAP Privilege Escalation (3194674)

A privilege escalation vulnerability exists in SAP NetWeaver Application Server ABAP. This can be abused physically resulting in a privilege escalation of an attacker leading to low impact on confidentiality and integrity, but a profound impact on availability. Note that Nessus has not tested for...

SAP NetWeaver AS ABAP SSRF (3194674)

A server side request forgery vulnerability exists in SAP NetWeaver Application Server ABAP. This allows an authenticated user to misuse a function of sapcontrol webfunctionalitystartservice in Kernel which enables malicious users to retrieve information. On successful exploitation, an attacker c...

SAP Multiple Products HTTP Request Smuggling Vulnerability

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the...

VulnCheck KEV: CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the...