CVE-2016-1911

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

CVE-2016-1910

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1910

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

Code injection

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1910

CVE-2016-1910 affects SAP NetWeaver 7.4 UME (User Management Engine) and is described as a cryptographic issue enabling attackers to decrypt data via unspecified vectors (SAP Security Note 2191290). The connected materials indicate this is a crypto-issue vulnerability with publicly available PoCs...

CVE-2016-1911

CVE-2016-1911 concerns SAP NetWeaver 7.4 with multiple cross-site scripting (XSS) vulnerabilities. The affected components are the Runtime Workbench (RWB) and the Pmitest servlet in the Process Monitoring Infrastructure (PMI). The underlying issue is XSS that could allow remote attackers to injec...

CVE-2016-1910

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1911

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

SAP Netweaver Java deserialization of untrusted user value in metadatauploader

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7400.12.21.30308 Vendor URL: SAP Bugs: DoS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 14.03.2017 Reference: SAP Security Note 2399804 Author: Vahagn VardanyanERPScan & Mathieu Geli ERPScan VULNERABILITY...

SAP Hostcontrol remote DOS

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.0 – 7.5 Vendor URL: SAP Bug: DoS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 13.06.2017 Reference: SAP Security Note 2389181 Authors: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: D...

SAP AS Java XSS in Enterprise Portal

Application: SAP NetWeaver AS Java Vendor URL: SAP Bugs: XSS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 09.05.2017 Reference: SAP Security Note 2412897 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS Impact: Account hijacking Remotely...

Potential backdoor via hardcoded system ID

Application: SAP NetWeaver AS ABAP Vendor URL: http://sap.com Bugs: Hardcoded credentials Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 10.05.2016 Reference: SAP Security Note 2292487 Author: Vahagn VardanyanERPScan VULNERABILITY INFORMATION Class: Hardcoded credential...

Scientific Linux Security Update : krb5 on SL7.x x86_64 (20151119)

It was found that the krb5readmessage function of MIT Kerberos did not correctly sanitize input, and could create invalid krb5data objects. A remote, unauthenticated attacker could use this flaw to crash a Kerberos child process via a specially crafted request. CVE-2014-5355 A flaw was found in t...

SAP NetWeaver J2EE Engine 7.40 SQL Injection

Application: SAP NetWeaver Versions Affected: SAP NetWeaver J2EE Engine 7.40 Vendor URL: http://SAP.com Bugs: SQL injection Send: 13.07.2015 Reported: 13.07.2015 Vendor response: 14.07.2015 Date of Public Advisory: 14.12.2015 Reference: SAP Security Note 2193389 Author: Vahagn Vardanyan ERPScan...

SAP NetWeaver AS JAVA - XSS vulnerability

Application: SAP NetWeaver Portal 7.4 Vendor URL: SAP Bug: XSS Reported: 12.08.2015 Vendor response: 13.08.2015 Date of Public Advisory: 14.06.2016 Reference: SAP Security Note 2256178 Author: Vahagn VardanyanERPScan VULNERABILITY INFORMATION Class: XSS Impact: modify displayed content from a Web...

SAP NetWeaver 7.4 XXE Injection Vulnerability

SAP NetWeaver version 7.4 suffers from an XML external entity injection vulnerability. Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of...

SAP NetWeaver 7.4 XXE Injection

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Author: Roman Bezhan...

SAP NetWeaver AS JAVA Unauthorized Access Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform. SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language. An unauthorized access vulnerability exists in SAP NetWeaver AS Java, which could be exploited by remote...

SAP Netwaver XML External Entity Injection Vulnerability

SAP Netwaver is a professional standards-based integrated application platform from SAP. The platform provides components such as portals, application servers and business intelligence solutions. An XML external entity injection vulnerability exists in SAP Netwaver versions prior to 7.01. An...