SAP Netweaver IUUC_RECON_RC_COUNT_TABLE_BIG SQL Injection

SEC Consult Vulnerability Lab Security Advisory ============================================================================== title: Remote ADBC SQL Injection in SAP IUUCRECONRCCOUNTTABLEBIG product: SAP Netweaver vulnerable version: see vulnerable/tested versions section below fixed version: se...

SAP Netweaver IUUC_RECON_RC_COUNT_TABLE_BIG ABAP Code Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote ABAP Code Injection in SAP IUUCRECONRCCOUNTTABLEBIG product: SAP Netweaver vulnerable version: SAP DMIS 20111731 SP 0013 fixed version: see solution section below...

CVE-2021-44235

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This...

CVE-2021-44235

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This...

CVE-2021-44235

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This...

Code injection

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This...

CVE-2021-44235

CVE-2021-44235 affects SAP NetWeaver AS ABAP (versions 700–756). The vulnerability arises from two methods of a utility class that, when invoked by a user with high privileges and direct access to the SAP system, allow code injection via the transaction class builder. This could enable execution ...

CVE-2021-44235

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This...

PT-2021-24073 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue allows an attacker with high privileges and direct access to the SAP System to inject code when executing a certai...

SAP NetWeaver AS 操作系统命令注入漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but is also the basic platform for SAP software. SAP NetWeaver AS ABAP suffers from an operating system command injection vulnerability that originates from allowing an attacker with elevated...

SAP NetWeaver Directory Traversal (CVE-2016-3976)

A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

The vulnerability of the Invoker Servlet component in SAP NetWeaver Java Application Server allows a perpetrator to execute arbitrary code or gain full control over the system.

The vulnerability of the Invoker Servlet component in SAP NetWeaver Java Application Server is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain full control over the system through specially crafted HTTP or...

The vulnerability of the BC-BMT-BPM-DSK component of the SAP NetWeaver Java Application Server allows attackers to perform XXE attacks.

The vulnerability of the BC-BMT-BPM-DSK component of the SAP NetWeaver Java Application Server is related to deficiencies in the mechanism for restricting XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

The vulnerability of SAP NetWeaver Java Application Server web applications lies in incorrect path name restrictions for access to restricted catalogs, allowing attackers to gain unauthorized access to protected information.

The vulnerability of SAP NetWeaver Java Application Server web applications relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information by sending a...

SAP NetWeaver AS ABAP Incorrect Authorization (November 2021)

An incorrect authorization vulnerability may be present in SAP NetWeaver Application Server ABAP. A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

Code injection

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...