PT-2021-24073 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue allows an attacker with high privileges and direct access to the SAP System to inject code when executing a certai...

SAP NetWeaver AS 操作系统命令注入漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but is also the basic platform for SAP software. SAP NetWeaver AS ABAP suffers from an operating system command injection vulnerability that originates from allowing an attacker with elevated...

SAP NetWeaver Directory Traversal (CVE-2016-3976)

A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

The vulnerability of the Invoker Servlet component in SAP NetWeaver Java Application Server allows a perpetrator to execute arbitrary code or gain full control over the system.

The vulnerability of the Invoker Servlet component in SAP NetWeaver Java Application Server is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain full control over the system through specially crafted HTTP or...

The vulnerability of the BC-BMT-BPM-DSK component of the SAP NetWeaver Java Application Server allows attackers to perform XXE attacks.

The vulnerability of the BC-BMT-BPM-DSK component of the SAP NetWeaver Java Application Server is related to deficiencies in the mechanism for restricting XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

The vulnerability of SAP NetWeaver Java Application Server web applications lies in incorrect path name restrictions for access to restricted catalogs, allowing attackers to gain unauthorized access to protected information.

The vulnerability of SAP NetWeaver Java Application Server web applications relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information by sending a...

SAP NetWeaver AS ABAP Incorrect Authorization (November 2021)

An incorrect authorization vulnerability may be present in SAP NetWeaver Application Server ABAP. A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

Code injection

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions...

CVE-2021-40504

CVE-2021-40504 affects SAP NetWeaver Application Server for ABAP/ABAP Platform; versions 700–756 include a template role with transport authorizations that exceed display-only permissions. Concretely, the issue is an incorrect/overly permissive authorization in the template role. No exploitation ...

PT-2021-22911 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue concerns a certain template role in SAP NetWeaver Application Server for ABA...

SAP NetWeaver Application Server 权限许可和访问控制问题漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A privilege permission and access control issue vulnerability exists in SAP NetWeaver Application Server, which arises from an application that does not properly impose security restrictions. The vulnerability can be...

SAP NetWeaver AS Java XXE Vulnerability (2296909)

An XML external entity XXE vulnerability exists in BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5. An authenticated, remote attacker can exploit this, to conduct XML External Entity XXE attacks via the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI, aka SAP Security Note 2296909. Note that Nessu...

SAP NetWeaver AS Java Directory Traversal Vulnerability (2547431)

A directory traversal vulnerability exists in SAP Netweaver Application Server Java CRM versions before 7.01, 7.02, 7.30, 7.31, 7.33, 7.54 due to insufficient validation of path information provided by users, thus characters representing traverse to parent directory are passed through to the file...

SAP NetWeaver Remote Code Execution Vulnerability

SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request...

SAP NetWeaver Directory Traversal Vulnerability

SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ dot dot backslash in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files...

SAP NetWeaver XML External Entity (XXE) Vulnerability

SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity XXE attacks...