SAP NetWeaver Portal 跨站脚本漏洞

SAP NetWeaver Portal is a component of SAP NetWeaver architecture from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Portal versions 7.30, 7.31, 7.40, and 7.50, which stems from a failure to adequately validate user-controlled input, and which can be exploited by an...

CVE-2022-32247: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the User inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

SAP NetWeaver AS Java Reverse Tabnabbing (2965315)

SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. The attacker could execute phishing attacks to steal credentials of the...

SAP NetWeaver AS ABAP Information Disclosure (2963137)

A user enumeration vulnerability may be present in SAP NetWeaver Application Server ABAP. This could be exploited to gain a list of user accounts and personal user information via the POWL test application, leading to information disclosure. Note that Nessus has not tested for this issue but has...

PT-2022-4081

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50 Description The issue is related to the failure to protect the web page structure, allowing a remote attacker to conduct cross-site scripting attacks. The vulnerability is caused by...

PT-2022-4082

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50 Description The issue is related to insufficient encoding of user-controlled inputs over the network, resulting in a reflected Cross-Site Scripting XSS vulnerability. This vulnerabilit...

PT-2022-4083

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50 Description The issue is related to insufficient encoding of user-controlled inputs over the network, resulting in a reflected Cross-Site Scripting XSS vulnerability. This vulnerabilit...

SAP NetWeaver Code Issue Vulnerability (CNVD-2022-56261)

SAP Netweaver is a set of integrated service-oriented application platform from SAP, a German company. The platform provides a development and runtime environment for SAP applications.SAP NetWeaver is vulnerable to a code issue. No detailed vulnerability details are available...

saprouttab file Arbitrary Command Execution

The vulnerability of the saprouttab file in SAP NetWeaver and SAP ABAP software integration platforms is related to authentication errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

SAP NetWeaver AS Java Information Disclosure (Enterprise Portal) (3059764)

SAP NetWeaver AS JAVA Enterprise Portal, versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in conjunction with other attacks such as XSS to steal this information. Note that Nessus has not tested for this issue but...

SAP NetWeaver AS Java Insufficient Logging

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted. Note that Nessus has not tested for this issue but has instead...

SAP NetWeaver J2EE Engine SQL Injection (CVE-2016-2386)

An SQL injection vulnerability exists in SAP NetWeaver J2EE Engine. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements on the affected system...

SAP NetWeaver Unrestricted File Upload (CVE-2021-38163)

An unrestricted file upload vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

SAP NetWeaver ABAP Improper Access Control (3158375)

Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform, from a remote client, for example stopping the SAProuter, that could highly impact...

SAP NetWeaver AS Java Information Disclosure (2256846)

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.1 to 7.5, allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Note that Nessus has not tested for this issue but has instead relied only on the application's...

SAP NetWeaver Developer Studio code issue vulnerability

SAP NetWeaver Developer Studio is a Java part of the integrated development environment IDE of the German company SAP. SAP NetWeaver Developer Studio is vulnerable to a code issue that could be exploited by an attacker to cause a loss of confidentiality and integrity...

SAP NetWeaver Development Infrastructure跨站脚本漏洞

SAP NetWeaver Development Infrastructure is an SAP company that provides a consistent development environment, development teams, and support for software development throughout the product lifecycle. A cross-site scripting vulnerability exists in SAP NetWeaver Development Infrastructure, which c...

CVE-2022-29614

SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, SAPHOSTAGENT 7.22, - on Unix systems,...

CVE-2022-29618

Due to insufficient input validation, SAP NetWeaver Development Infrastructure Design Time Repository - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to inject script into the URL and execute code in the user’s browser. On successful exploitation, an attacker can view or...

CVE-2022-29618

Due to insufficient input validation, SAP NetWeaver Development Infrastructure Design Time Repository - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to inject script into the URL and execute code in the user’s browser. On successful exploitation, an attacker can view or...