CVE-2021-40504

CVE-2021-40504 affects SAP NetWeaver Application Server for ABAP/ABAP Platform; versions 700–756 include a template role with transport authorizations that exceed display-only permissions. Concretely, the issue is an incorrect/overly permissive authorization in the template role. No exploitation ...

PT-2021-22911 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue concerns a certain template role in SAP NetWeaver Application Server for ABA...

SAP NetWeaver Application Server 权限许可和访问控制问题漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A privilege permission and access control issue vulnerability exists in SAP NetWeaver Application Server, which arises from an application that does not properly impose security restrictions. The vulnerability can be...

SAP NetWeaver AS Java XXE Vulnerability (2296909)

An XML external entity XXE vulnerability exists in BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5. An authenticated, remote attacker can exploit this, to conduct XML External Entity XXE attacks via the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI, aka SAP Security Note 2296909. Note that Nessu...

SAP NetWeaver AS Java Directory Traversal Vulnerability (2547431)

A directory traversal vulnerability exists in SAP Netweaver Application Server Java CRM versions before 7.01, 7.02, 7.30, 7.31, 7.33, 7.54 due to insufficient validation of path information provided by users, thus characters representing traverse to parent directory are passed through to the file...

SAP NetWeaver Remote Code Execution Vulnerability

SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request...

SAP NetWeaver Directory Traversal Vulnerability

SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ dot dot backslash in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files...

SAP NetWeaver XML External Entity (XXE) Vulnerability

SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity XXE attacks...

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users...

SAP Netweaver Cross-Site Scripting Vulnerability (CNVD-2021-103657)

SAP Netweaver is a set of integrated service-oriented application platforms from SAP, a German company. SAP Netweaver is vulnerable to a cross-site scripting vulnerability in versions 700, 701, 702, and 730, which stems from under-coded user-controlled input. The vulnerability could be exploited ...

SAP NetWeaver Application Server Denial of Service Vulnerability

A denial-of-service vulnerability exists in SAP NetWeaver Application Server for ABAP versions 740, 750, 751, 752, 753, 754, 755, which The vulnerability originates from anomalous server handling and can be exploited by an unauthorized attacker to degrade the performance of sap NetWeaver...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (Oct 2021)

Multiple vulnerabilities may be present in SAP NetWeaver Application Server ABAP, including the following: - SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service,...

The vulnerability of the JMS Connector Service server in SAP NetWeaver Java Application Server allows attackers to circumvent existing security restrictions or execute arbitrary code.

The vulnerability of the JMS Connector Service server in SAP NetWeaver Java Application Server applications is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions or execute arbitrary code by...

The vulnerability of the Visual Composer browser-based modeling tool of the SAP NetWeaver software integration platform allows a perpetrator to escalate their privileges, execute arbitrary commands, or cause service interruptions.

The vulnerability of the Visual Composer browser-based modeling tool of the SAP NetWeaver software integration platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability can allow a remote attacker to enhance their privileges, execute arbitrary commands, or cau...

CVE-2021-40499

Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...

CVE-2021-40495

There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application...

CVE-2021-40495

There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755. An unauthorized attacker can use the public SICF service /sap/public/bc/abap to reduce the performance of SAP NetWeaver Application...

CVE-2021-38181

SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2021-38183

SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in...

CVE-2021-38181

SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...