CVE-2012-1290

Cross-site scripting XSS vulnerability in b2b/auction/container.jsp in the Internet Sales crm.b2b module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the loadPage parameter...

CVE-2012-1290

The CVE-2012-1290 entry describes a Cross-site scripting (XSS) vulnerability in SAP NetWeaver 7.0, specifically in the Internet Sales (crm.b2b) module and the b2b/auction/container.jsp page. The issue is exploitable via the _loadPage parameter, allowing an attacker to inject arbitrary web script ...

CVE-2012-1291

Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servletjsp service...

CVE-2012-1289

SAP NetWeaver 7.0 is affected by multiple directory traversal vulnerabilities in log.jsp/log_view.jsp under Internet Sales (crm.b2b) and Application Administration (com.sap.ipc.webapp.ipc). The root cause is improper validation of the logfilename parameter, allowing remote authenticated users to ...

CVE-2012-1289

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to 1 b2b/admin/log.jsp or 2 b2b/admin/logview.jsp in the Internet Sales crm.b2b component, or 3 ipc/admin/log.jsp or 4...

SAP NetWeaver多个输入验证漏洞

BUGTRAQ ID: 52101 SAP NetWeaver是SAP的集成技术平台和自从SAP Business Suite以来的所有SAP应用的技术基础。 SAP NetWeaver在实现上存在XSS、目录遍历、信息泄露漏洞，攻击者可利用这些漏洞执行任意脚本代码、窃取信息。 0 SAP NetWeaver 7.0 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sap.com/platform/netweaver/index.epx...

PT-2012-3177

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.0 Description The issue allows remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to API endpoints such as "b2b/admin/log.jsp" or "b2b/admin/log view.jsp" in the Internet...

PT-2012-3180

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.0 Description The issue allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data. Recommendations For SAP NetWeaver version 7.0, consider restricting access to the MessagingSyst...

CVE-2012-1292: Undefined Security Weakness

Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors...

CVE-2012-1291: Undefined Security Weakness

Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servletjsp service...

CVE-2012-1289: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to 1 b2b/admin/log.jsp or 2 b2b/admin/logview.jsp in the Internet Sales crm.b2b component, or 3 ipc/admin/log.jsp or 4...

PT-2012-3179

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.0 Description The issue allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servlet jsp service...

CVE-2012-1290: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in b2b/auction/container.jsp in the Internet Sales crm.b2b module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the loadPage parameter...

PT-2012-3178

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.0 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the loadPage parameter in the b2b/auction/container.jsp file within the Internet...

CVE-2011-4707

Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...

CVE-2011-4707

Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...

CVE-2011-4707

CVE-2011-4707 involves multiple cross-site scripting (XSS) vulnerabilities in the SAP NetWeaver Virus Scan Interface. The flaws allow remote attackers to inject arbitrary web script or HTML via the following parameters: (1) instname to VsiTestScan servlet and (2) name to VsiTestServlet servlet. A...

PT-2011-5042

Name of the Vulnerable Software and Affected Versions SAP Netweaver affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface of SAP Netweaver. These vulnerabilities allow remote attackers to inject arbitrary web...

CVE-2011-4707: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...