SAP Netweaver wsnavigator — XSS Security Vulnerability

Application: SAP Netweaver Versions Affected: Version 6.4-7.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 26.05.2009 Vendor response: 27.05.2009 Date of Public Advisory: 13.07.2010 Author: Alexander Polyakov Description SAP Netweaver system has linked XSS security vulnerability in wsnavigator...

SAP Cfolders Multiple Linked XSS Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-021 Original advisory: http://dsecrg.com/pages/vul/show.php?id=121 Application: SAP Cfolders SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms collaboration rooms Vendor URL: http://SAP.com Bugs: Multiple Liked XSS Risk:...

SAP Cfolders Multiple Stored XSS Vulnerabilies

Digital Security Research Group DSecRG Advisory DSECRG-09-014 Original advisory: http://dsecrg.com/pages/vul/show.php?id=114 Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: http://SAP.com Bugs: Multiple Stored XSS Risk: Hight...

SAP Cfolders Stored Cross Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-09-014 Original advisory: http://dsecrg.com/pages/vul/show.php?id=114 Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: http://SAP.com Bugs: Multiple Stored XSS Risk: Hight...

SAP NetWeaver Application Server (UDDI client) XSS Vulnerability

Application: SAP NetWeaver Application Server Java Versions Affected: Version 7.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date of Public Advisory: 11.08.2009 Reference: SAP Security Note 1322098 Author: Alexandr Polyakov Description SAP NetWeaver...

SAP NetWeaver和Web Dynpro Portal跨站脚本执行漏洞

BUGTRAQ ID: 33465 SAP NetWeaver是一种企业IT系统整合管理系统。 SAP NetWeaver的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞控制应用系统。 SAP NetWeaver没有对用户提交的数据做充分的检查过滤，远程攻击者可能在输入中插入来意脚本代码，使用此应用的其他用户客户端浏览器可能会执行攻击者提交脚本代码，构成跨站脚本执行攻击。Web Dynpro Portal应用也存在类似的问题。 SAP NetWeaver 4.x 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-3358

Cross-site scripting XSS vulnerability in Web Dynpro WD in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document...

Cross site scripting

Cross-site scripting XSS vulnerability in Web Dynpro WD in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document...

CVE-2008-3358

Cross-site scripting XSS vulnerability in Web Dynpro WD in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document...

CVE-2008-3358

CVE-2008-3358 is an XSS vulnerability in SAP NetWeaver Portal’s Web DynPro component. A crafted URI can reflect arbitrary script/HTML in a text/plain response when using Internet Explorer 7.0.5730, enabling remote attackers to execute client-side code in the victim’s browser. Root cause is unenco...

SAP NetWeaver XSS Vulnerability

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: NetWeaver/Web DynPro Vendor: SAP www.sap.com CVD ID: CVE-2008-3358 Subject: Cross-Site Scripting Vulnerability Risk: High Effect: Remotely exploitable Author: Martin Suess [email protected] Date: January 27th 20...

Errata: [TZO-2009-1] Avira Antivir - RAR - Division by Zero & Null Pointer Dereference

Errata : Products listed but not affected : AVIRA WebProtector for KEN! - Reason: Does not use the Scan Engine Avira AntiVir Mobile - Reason: Does not use the same AV Engine Avira requested the following products to be removed from the list, for the reason that they are license models and not...

Cross site scripting

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" aka Editor Security or Secure Editing parameter, which allows remote attackers to conduct cross-site scripting XSS attacks by entering feedback for a file...

CVE-2008-1846

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" aka Editor Security or Secure Editing parameter, which allows remote attackers to conduct cross-site scripting XSS attacks by entering feedback for a file...

CVE-2008-1846

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" aka Editor Security or Secure Editing parameter, which allows remote attackers to conduct cross-site scripting XSS attacks by entering feedback for a file...

CVE-2008-1846

The CVE affects SAP NetWeaver prior to 7.0 SP15 where the Always Use Secure HTML Editor (Editor Security) parameter is not enabled by default. This configuration allows remote attackers to perform cross-site scripting (XSS) by entering feedback for a file, as described in the public records. No a...

SAP Cfolders Multiple Stored XSS Vulnerabilies

Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: Bugs: Multiple Stored XSS Risk: High Exploits: YES Reported: 04.12.2008 Vendor response: 05.12.2008 Vulnerability patched: 15.12.2008 Date of Public Advisory: 21.04.2009 Referenc...

SAP Netweaver 6.40-7.0 Cross-Site-Scripting

Title: SAP Netweaver 6.40-7.0 Persistent Cross-Site-Scripting Author: Jaime Blasco at aitsec.com http://www.aitsec.com Description: SAP Netweaver have a web interface for accesing filesystem of the portal, users can make "feedbacks" of files, input passed to the content of these feedbacks is not...

Design/Logic Flaw

Internet Communication Manager aka ICMAN.exe or ICM in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service process crash via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web...

CVE-2007-3615

Internet Communication Manager aka ICMAN.exe or ICM in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service process crash via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web...