CVE-2023-35872 Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)

The Message Display Tool MDT of SAP NetWeaver Process Integration - version SAPXIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The...

CVE-2023-33989 Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)

An attacker with non-administrative authorizations in SAP NetWeaver BI CONT ADD ON - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system...

CVE-2023-33989 Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)

An attacker with non-administrative authorizations in SAP NetWeaver BI CONT ADD ON - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system...

CVE-2023-33989

CVE-2023-33989 concerns SAP NetWeaver BI CONT ADD ON (versions 707, 737, 747, 757) with a directory traversal flaw that can overwrite system files. The root cause is improper path filtering, allowing an attacker with non-administrative authorizations (network access) to target OS files and potent...

CVE-2023-31405 Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any...

CVE-2023-31405

SAP NetWeaver AS for Java (ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50) is affected by a log-injection vulnerability via unauthenticated network requests that can modify system logs without user interaction. The root cause is log injection from network input; there is no information disclosur...

CVE-2023-31405 Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any...

SAP NetWeaver 路径遍历漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A path traversal vulnerability exists in SAP NetWeaver, which results from the program failing to properl...

PT-2023-4071 · Sap · Sap Netweaver Process Integration

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Process Integration version SAP XIAF 7.50 Description: The issue is related to the Message Display Tool MDT component of SAP NetWeaver Process Integration, which lacks proper authentication checks for certain functionalities. Th...

SAP NetWeaver Application Server 授权问题漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. An authorization issue vulnerability exists in SAP NetWeaver Application Server ABAP and ABAP Platform, which arises from performing incorrect authentication checks for functions that require a user's identity under...

SAP NetWeaver Process Integration 访问控制错误漏洞

SAP NetWeaver Process Integration PI is an SAP enterprise application integration software from SAP, Germany, and is a component of the NetWeaver product group. The component is mainly used for the exchange of information between the internal system and the external. An access control error...

SAP NetWeaver ABAP Server 操作系统命令注入漏洞

SAP NetWeaver ABAP Server is a German SAP SAP company used as a Web application server for SAP products. SAP NetWeaver ABAP Server suffers from an operating system command injection vulnerability that arises from the application failing to properly filter constructor command special characters,...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including. Business Objects, ECC, HANA, Netweaver, Business Warehouse and Solution Manager. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Cross-Site Scripting XSS...

SAP NetWeaver 安全漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in SAP NetWeaver Application Server for Java that originates from allowing an...

PT-2023-4629 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java versions 7.50 Description: The issue allows an unauthenticated attacker to craft a request over the network, resulting in unwarranted modifications to a system log without user interaction. It is related to incorrect...

PT-2023-4095 · Sap · Abap Platform +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform versions 7.22 through 7.93 Description: The issue is related to improper authentication checks for functionalities that require user identity. This can allow an attacker to perform...

Security Bulletin: Watson CP4D Data Stores is vulnerable to SAP NetWeaver AS for JAVA security bypass vulnerability ( CVE-2023-30744)

Summary Potential SAP NetWeaver AS for JAVA security bypass vulnerability CVE-2023-30744 has been identified that may affect Watson CP4D Data Stores. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-30744 DESCRIPTION: SAP NetWeaver AS for JAVA could allow a remote...

PT-2023-4244 · Sap · Abap Platform +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP BASIS 700, SAP BASIS 701, SAP BASIS 702, SAP BASIS 731, SAP BASIS 740, SAP BASIS 750, SAP BASIS 752, SAP BASIS 753, SAP BASIS 754, SAP BASIS 755, SAP BASIS 756, SAP BASIS...

SAP NetWeaver Resource Management Error Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A resource management error vulnerability exists in SAP NetWeaver, which can be exploited by an attacker ...

SAP NetWeaver Enterprise Portal Cross-Site Scripting Vulnerability (CNVD-2023-65184)

SAP NetWeaver Enterprise Portal is a SAP NetWeaver Web front-end component from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain sensitive...