CVE-2007-3615

SAP NetWeaver Application Server’s Internet Communication Manager (ICM/ICMAN.exe) in 6.x–7.x (Windows possibly) is vulnerable to a denial-of-service via a long URI containing sap-isc-key, related to web cache configuration. The connected documents do not provide additional technical details, expl...

CVE-2007-3496

Cross-site scripting XSS vulnerability in SAP Web Dynpro Java BC-WD-JAV in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to inject arbitrary web...

CVE-2007-3496

SAP Web Dynpro Java (BC-WD-JAV) in SAP NetWeaver Nw04 SP15–SP19 and Nw04s SP7–SP11 is affected by a cross-site scripting (XSS) vulnerability that can be triggered via the User-Agent HTTP header. Affected components include SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Co...

CVE-2007-3496

Cross-site scripting XSS vulnerability in SAP Web Dynpro Java BC-WD-JAV in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to inject arbitrary web...

SAP NetWeaver和Web Dynpro Java跨站脚本漏洞

SAP Web Dynpro Java是一款Java的WEB应用服务程序。 SAP Web Dynpro Java不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 NetWeaver Application包含的User-Agent-Header内容在服务器应答时没有采用正确的编码，伪造User-Agent-Header可触发跨站脚本问题，构建恶意WEB页，诱使用户访问，可导致获得目标用户敏感信息。 SAP NetWeaver Nw04s SP9 SAP NetWeaver Nw04s SP8 SAP NetWeaver Nw04s SP7 SAP...

SAP NetWeaver / Web Dynpro Java multiple security vulnerabilities

Multiple crossite scripting conditions...

SAP Web Dynpro Java (BC-WD-JAV) Vulnerability

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: NetWeaver, Web Dynpro Java BC-WD-JAV Vendor: SAP Subject: Multiple XSS, HTML Injection Risk: Medium Effect: Remotely exploitable Author: Cyrill Brunschwiler [email protected] Date: June, 17th 2007 Introduction: ------------- Compass...

SAP Web Application Server http request url parsing vulnerability

Advisory Name: SAP Web Application Server http request url parsing vulnerability Release Date: 01/03/2006 Affected Applications: SAP WebAS Kernel up to version 7.00 Affected Platforms: Platform-Independant Local / Remote: Remote Severity: Medium to High Author: A. Grossmann arnold.grossmann at...