CVE-2020-6202

CVE-2020-6202 concerns SAP NetWeaver Application Server Java (User Management Engine), affected in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50. The issue is that the LDAP data source configuration XML document accepted from an untrusted source is not sufficiently validated, leading to Missi...

CVE-2020-6203: Improper Limitation of a Pathname to a Restricted Directory

SAP NetWeaver UDDI Server Services Registry, versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to...

CVE-2020-6205: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS ABAP Business Server Pages Smart Forms, SAPBASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content...

PT-2020-19003

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java User Management Engine versions 7.10 through 7.50 Description The issue arises from insufficient validation of the LDAP data source configuration XML document accepted from an untrusted source, leading to...

PT-2020-19004

Name of the Vulnerable Software and Affected Versions SAP NetWeaver UDDI Server Services Registry versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description The issue allows an attacker to exploit insufficient validation of path information provided by users. This leads to Path Traversal, as...

PT-2020-19006 · Sap · Sap Netweaver As Abap +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Business Server Pages Smart Forms, SAP BASIS versions 7.00 through 7.54 Description: The issue arises from insufficient encoding of user-controlled inputs, allowing an unauthenticated attacker to non-permanently deface o...

CVE-2020-6202: Improper Input Validation

SAP NetWeaver Application Server Java User Management Engine, versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation...

CVE-2015-7968

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

CVE-2015-7968

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

Design/Logic Flaw

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

CVE-2015-7968

SAP NetWeaver Application Server is affected by CVE-2015-7968 due to the nwbc_ext2int component, which allows XXE-based local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI. The root cause is improper XML entity handling in nwbc_ext2int, enabling access to local files. The vulnerability...

CVE-2015-7968

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

PT-2020-7900

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server before Security Note 2183189 Description: The issue allows XXE attacks for local file inclusion via the "sap/bc/ui2/nwbc/nwbc ext2int/" URI. This can be exploited to access local files. Recommendations: For SA...

CVE-2015-7968: Improper Restriction of XML External Entity Reference

nwbcext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbcext2int/ URI...

SAP NetWeaver and S/4HANA Cross-Site Scripting Vulnerability

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver and S/4HANA. The vulnerability stems from a lack of...

SAP NetWeaver AS Java Information Disclosure Vulnerability (CNVD-2020-18535)

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. An information disclosure vulnerability exists in SAP NetWeaver AS Java. An attacker can exploit thi...

SAP NetWeaver Keystore Disclosure

The vulnerability of the SAP NetWeaver software integration platform’s keystore service is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

SAP NetWeaver ABAP Online Community Stored Cross-Site Scripting Vulnerability

SAP NetWeaver is SAP's integrated technology platform. A cross-site scripting vulnerability exists in SAP NetWeaver ABAP Online Community, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to gain access to sensitive information or hijack user...

SAP NetWeaver XML Processing Denial of Service Vulnerability

SAP NetWeaver is SAP's integrated technology platform. A security vulnerability exists in SAP NetWeaver's handling of XML documents, which can be exploited by remote attackers to submit a special request for a denial-of-service attack...

SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2020-13196)

SAP NetWeaver is SAP's integrated technology platform. A cross-site scripting vulnerability exists in SAP NetWeaver, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive information or hijack user sessions when malicious data is...