[DSECRG-11-012] SAP NetWeaver Integration Directory - multiple XSS

DSECRG-11-012 SAP NetWeaver Integration Directory - multiple XSS SAP NetWeaver Integration Directory has multiple linked XSS vulnerabilities. Digital Security Research Group DSecRG Advisory DSecRG-11-012 Internal DSecRG-00159 Application: SAP NetWeaver XI Versions Affected: SAP NetWeaver XI Vendo...

[DSECRG-11-009] SAP NetWaver XI SOAP Adapter - XSS

DSECRG-11-009 SAP NetWaver XI SOAP Adapter - XSS SAP NetWeaver 7.0 application XI SOAP Adapter has linked XSS vulnerability Digital Security Research Group DSecRG Advisory DSecRG-11-009 Internal DSecRG-00120 Application: SAP NetWeaver Versions Affected: SAP NetWeaver XI SOAP Adapter 3.0-7.11 Vend...

[DSECRG-11-010] SAP NetWeaver logon.html - XSS

DSECRG-11-010 SAP NetWeaver logon.html - XSS SAP NetWeaver BSP logon page has linked XSS vulnerability. Digital Security Research Group DSecRG Advisory DSecRG-11-010 Internal DSecRG-00127 Application: SAP NetWeaver Versions Affected: SAP NetWeaver SAPBASIS 620-730 Vendor URL: http://www.sap.com...

SAP RSTXSCRP report - smb relay vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Path traversal, SMBRelay Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 2.1 Author: Dmitriy Chastuchin Description SAP RSTXSCRP Report has path...

SAP BW Doc - Multiple XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Linked XSS Vulnerability Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 4.3 Author: Alexandr Polyakov and Dmitriy Chastuchin Description BW DOC...

SAP Application Administration - local file read

Application: SAP NetWeaver Vendor URL: Bugs: Local file read Risk: High Exploits: YES Reported: 14.03.2011 Vendor response: 15.03.2011 Date of Public Advisory: 17.02.2012 Reference: SAP Security Note 1585527 Description SAP NetWeaver 7.0 Application Administration com.sap.ipc.webapp.ipc has local...

SAP NetWeaver Runtime — Multiple XSS

Description SAP NetWeaver Integration Directory has linked XSS vulnerability: XSS in errormsg.jsp XSS in ViewCaches.jsp Stored XSS in ViewLogger.jsp POST and Stored XSS in ShowMemLog Business Risk An attacker can use XSS vulnerability by sending a link on malicious script to an unaware user via a...

SAP NetWeaver - Authentication bypass (Verb Tampering)

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Auth bypass, Verb tampering Exploits: YES Reported: 14.03.2011 Vendor response:15.03.2011 Date of Public Advisory:11.11.2011 CVSS: 10 by ERPSCAN 7.3 by SAP Author:Alexandr Polyakov Description...

SAP NetWeaver TH_GREP module - Code injection vulnerability (NEW)

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Command execution Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 6.0 Author: Alexey Tyurin Description THGREP report is vulnerable for command...

SAP NetWeaver SPML - XML CSRF user creation

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Command execution Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 7.3 Author: Alexandr Polyakov Description Attacker can create a new user in J2EE...

SAP NetWeaver RWB - unauthorized access

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Auth bypass Exploits: YES Reported: 15.02.2011 Vendor response:16.02.2011 Date of Public Advisory:20.01.2011 Author:Alexandr Polyakov Description Unauthorized access is possible to some Runtime Workben...

SAP NetWeaver Monitoring Systeminfo - Multiple XSS

Application: SAP NetWeaver Vendor URL: Bugs: XSS Risk: Medium Exploits: YES Reported: 15.02.2011 Vendor response: 17.02.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1568003 Author: Alexander Polyakov ERPScan Description SAP NetWeaver Monitoring...

SAP GUI BAPI Explorer- Unauthorized execution of function

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Unauthorized execution Exploits: YES Reported: 15.02.2011 Vendor response:16.02.2011 Date of Public Advisory:11.11.2011 Author: Dmitriy Chastuchin Description SAP GUI BAPI Explorer has stored XSS which...

SAP NetWeaver ipcpricing - information disclose

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Information disclosure Exploits: YES Reported: 27.01.2011 Vendor response:28.01.2011 Date of Public Advisory: 15.09.2011 Author: Dmitriy Chastuchin Description com.sap.ipc.webapp.ipcpricing application...

SAP RFC EPS_DELETE_FILE — Authorisation bypass, smbrelay

Application: SAP NetWeaver ABAP Versions Affected: SAP NetWeaver ABAP Vendor URL: http://www.sap.com Bugs:Auth bypass, directory traversal, smbrelay Exploits: YES Reported: 15.01.2011 Vendor response: 25.01.2011 Date of Public Advisory: 22.08.2011 Author: Alexey Sintsov Description Security...

CVE-2010-4556

Stack-based buffer overflow in the SapThemeRepository ActiveX control sapwdpcd.dll in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the 1 Load and 2 LoadTheme methods...

Stack overflow

Stack-based buffer overflow in the SapThemeRepository ActiveX control sapwdpcd.dll in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the 1 Load and 2 LoadTheme methods...

CVE-2010-4556

Stack-based buffer overflow in the SapThemeRepository ActiveX control sapwdpcd.dll in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the 1 Load and 2 LoadTheme methods...

CVE-2010-4556

CVE-2010-4556 describes a stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) used by SAP NetWeaver Business Client. The vulnerability allows remote attackers to execute arbitrary code via the Load and LoadTheme methods. Affected software/component is the SapTheme...

CVE-2010-4556: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the SapThemeRepository ActiveX control sapwdpcd.dll in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the 1 Load and 2 LoadTheme methods...