CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

CVE-2017-8913

The CVE-2017-8913 vulnerability affects SAP NetWeaver AS JAVA 7.5, specifically the Visual Composer VC70RUNTIME component. Affected files/components include VC70RUNTIME (7.30–7.50) and VCFRAMEWORK/VCFLEX7.00 as listed in public advisories. The issue is an XML External Entity (XXE) vulnerability t...

PT-2017-18618

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.5 Description The issue allows remote authenticated users to conduct XML External Entity XXE attacks. This is achieved by sending a crafted XML document in a request to the...

CVE-2017-8913: Improper Restriction of XML External Entity Reference

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

SAP NetWeaver AS Java ES UDDI SQL Injection Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications. SAP NetWeaver AS Application Server Java is an application server that runs in NetWeaver and is based on the Java programming language. ES UDDI i...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

SAP Java P4 SLD SSRF

Application: SAP NetWeaver Versions Affected: SAP Netweaver 7.4, 7.5 Vendor URL: SAP Bug: SSRF Reported: 05.10.2017 Vendor response: 06.10.2017 Date of Public Advisory: 13.02.2018 Reference: SAP Security Note 2565622 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: Missing...

RCE via path Traversal using CSRF in SAP CRM

Application: SAP NetWeaver Versions Affected: SAP CRM 13676083 Vendor URL: SAP Bugs: CSRF, Path Traversal Reported: 05.10.2017 Vendor response: 06.10.2017 Date of Public Advisory: 13.02.2018 Reference: SAP Security Note 2547431 Author: Vahagn Vardanyan ERPScan, Vladimir Egorov ERPScan VULNERABILI...

HANA server memory disclosure

Application: SAP NetWeaver Versions Affected: SAP HANA 1.0, 2.0 all versions Vendor URL: SAP Bugs: Information Disclosure Reported: 05.10.2017 Vendor response: 06.10.2017 Date of Public Advisory: 13.02.2018 Reference: SAP Security Note 2572940 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATIO...

CVE-2017-7717

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7717

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

Sql injection

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7717

The CVE-2017-7717 entry concerns SAP NetWeaver AS Java 7.4, specifically the ES UDDI component. The vulnerability arises in the getUserUddiElements method, described as an SQL injection that permits remote authenticated users to execute arbitrary SQL commands via unspecified vectors. This is supp...

CVE-2017-7717

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

PT-2017-17903

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java version 7.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is due to a SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component. Recommendatio...

CVE-2017-7717: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

SAP NetWeaver TREX and BWA Remote Code Execution Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A remote code execution vulnerability exists in SAP NetWeaver TREX and BWA, which can be exploited by attackers ...

SAP NetWeaver Buffer Overflow Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A buffer overflow vulnerability exists in SAP NetWeaver versions 7.0 through 7.5. A remote attacker could exploi...

CVE-2016-10311

Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port, aka SAP Security Note 2295238...