CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

CVE-2021-38163 affects SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30/7.31/7.40/7.50 with an unrestricted file upload path traversal that, when exploited by an authenticated non-administrative user, can trigger processing of a malicious file and execute OS commands under the Java Server pro...

CVE-2021-37535

SAP NetWeaver Application Server Java JMS Connector Service - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for user privileges...

CVE-2021-37535

CVE-2021-37535 affects SAP NetWeaver Application Server Java, specifically the JMS Connector Service . Affected versions: 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 . Root cause described in sources as missing/incorrect authorization checks for user privileges, enabling a remote attacker to bypass author...

CVE-2021-21489

CVE-2021-21489 affects SAP NetWeaver Enterprise Portal versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. Root cause: insufficient encoding of user-related data leading to Stored XSS, enabling an attacker with administrative privileges to store malicious scripts that could affect portal conte...

CVE-2021-21489

SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-Site Scripting XSS vulnerability. This would allow an attacker with administrative privileges to store a malicious script on the portal. T...

CVE-2021-37531

SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be...

CVE-2021-37531

SAP NetWeaver Knowledge Management XML Forms (versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50) is affected by an XSLT processing vulnerability that allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet containing OS-level commands, place it where the system can access...

PT-2021-4347 · Sap · Sap Netweaver Application Server Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java JMS Connector Service versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description: The issue is related to the JMS Connector Service in SAP NetWeaver Java Application Server, where there are shortcomings in t...

SAP Enterprise Portal 跨站脚本漏洞

SAP Enterprise Portal is an application from SAP, Germany. A comprehensive integration and application platform that facilitates the alignment of people, information, and business processes across organizational and technological boundaries. A cross-site scripting vulnerability exists in SAP...

SAP NetWeaver Application Server Java 授权问题漏洞

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used for developing and running Java EE applications. An authorization issue vulnerability exists in SAP NetWeaver Application Server Java version...

PT-2021-6147 · Sap · Sap Netweaver Development Infrastructure Component Build Service

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Development Infrastructure Component Build Service versions 7.11 through 7.50 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in the SAP NetWeaver Development Infrastructure Component Build...

SAP Patches Nine Critical & High-Severity Bugs

SAP has released 19 new and updated security patches, three of them rated as “HotNews” critical and six as high-priority. “HotNews” is the severity rating that SAP gives to critical vulnerabilities. Two of this month’s sizzlers have a CVSS score of 9.9 and affect SAP Business One and SAP NetWeave...

CVE-2021-33703

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-33707

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity...

CVE-2021-33707

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity...

CVE-2021-33703

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-33702

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets...

CVE-2021-33702

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets...