SAP NetWeaver AS ABAP HTTP Rapid Reset (Jan 2024)

SAP NetWeaver Application Server for ABAP and ABAP Platform are vulnerable to a denial of service server resource consumption in the HTTP/2 protocol. This occurs because request cancellation can reset many streams quickly. Note that Nessus has not tested for this issue but has instead relied only...

CVE-2024-21738

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

CVE-2024-21738

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

Cross site scripting

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

CVE-2024-22124 Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager

Under certain conditions, Internet Communication Manager ICM or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, WEBDISP 7.22EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access...

CVE-2024-22124 Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager

Under certain conditions, Internet Communication Manager ICM or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, WEBDISP 7.22EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access...

CVE-2024-21738 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

CVE-2024-21738 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

CVE-2024-21738

CVE-2024-21738 concerns SAP NetWeaver ABAP Application Server and ABAP Platform. The vulnerability arises because user-controlled inputs are not sufficiently encoded, leading to a Cross-Site Scripting (XSS) issue. An attacker with low privileges can exploit this to cause a limited impact on the c...

CVE-2024-21738: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

SAP NetWeaver ABAP Server 跨站脚本漏洞

SAP NetWeaver ABAP Server is a German SAP SAP company used as a Web application server for SAP products. A cross-site scripting vulnerability exists in SAP NetWeaver ABAP Server, which stems from a cross-site scripting XSS vulnerability due to insufficient encoding of user-controlled input. An...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including SAP, Netweaver, SAP GUI and HANA. A malicious person could exploit them to carry out attacks that can lead to the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Circumvention of security measure. Remote...

PT-2024-1544

Name of the Vulnerable Software and Affected Versions SAP NetWeaver ABAP Application Server and ABAP Platform affected versions not specified Description The issue arises from insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability. An attacker with...

CVE-2017-9844

creationtimestamp| type| source ---|---|--- 2024-01-06 18:40:59+00:00| seen| https://t.me/arpsyndicate/2569 2025-04-25 08:41:00+00:00| seen| https://thehackernews.com/2025/04/sap-confirms-critical-netweaver-flaw.html 2025-04-25 13:37:42+00:00| seen|...

SAP NetWeaver AS ABAP Information Disclosure (3392547)

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase...

Vulnerabilities fixed in SAP

SAP has fixed vulnerabilities in several products, including. Business Objects, SAP GUI, Master Data Governance, Netweaver and Solution Manager. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Cross-Site Scripting XSS...

CVE-2023-49581 SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase...

SAP NetWeaver DI Server-Side Request Forgery

A Server-Side Request Forgery SSRF has been discovered in the SAP Development Infrastructure - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50. This vulnerability allows an unauthenticated attacker to perform proxy requests on the server or internal network via a crafted request. No source data...

SAP NetWeaver KW Reflected Cross-Site Scripting

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data. No source data...

SAP NetWeaver AS ABAP Information Disclosure (3362849)

SAP NetWeaver Application Server ABAP and ABAP Platform are affected by an information disclosure vulnerability. Under certain conditions SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to access unintended data due to a lack of applied restrictions, which may lead to low...