CVE-2021-21485

An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM hashes of a privileged user...

CVE-2021-27601

SAP NetWeaver AS Java Applications based on HTMLB for Java allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting XSS vulnerability and the attacker can read and modify data. However, the attack...

CVE-2021-27601

CVE-2021-27601 affects SAP NetWeaver AS Java (Applications based on HTMLB for Java). An authorized, basic-level attacker can store a malicious file on the server; when a victim opens that file, a Cross-Site Scripting (XSS) vulnerability can allow reading and modification of data. The root cause i...

CVE-2021-27603

The CVE-2021-27603 entry concerns SAP NetWeaver AS ABAP. It affects SAP NetWeaver AS ABAP versions 731, 740, and 750, where the RFC function module SPI_WAIT_MILLIS can be invoked to keep a work process busy, enabling an attacker to repeatedly call it and block all work processes, causing a Denial...

CVE-2021-27603

An RFC enabled function module SPIWAITMILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the...

CVE-2021-21492

SAP NetWeaver AS Java (HTTP Service) is affected by a content spoofing vulnerability (CVE-2021-21492) due to insufficient validation of the login group in URLs, enabling content spoofing when directory listings are enabled. Affected versions include 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. E...

CVE-2021-21492

SAP NetWeaver Application Server JavaHTTP Service, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a content spoofing vulnerability when directory listing is enabled...

CVE-2021-21482

The CVE-2021-21482 entry concerns SAP NetWeaver Master Data Management (SAP MDM) versions 710 and 710.750. According to the connected documents, an information-disclosure vulnerability exists where a malicious unauthenticated user with access to the MDM Server subnet can brute-force passwords, po...

CVE-2021-21482

SAP NetWeaver Master Data Management, versions - 710, 710.750, allows a malicious unauthorized user with access to the MDM Server subnet to find the password using a brute force method. If successful, the attacker could obtain access to highly sensitive data and MDM administrative privileges...

CVE-2021-27598

SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...

CVE-2021-27598

SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet) vulnerability CVE-2021-27598 affects SAP NetWeaver AS JAVA versions 7.31, 7.40, and 7.50. The root cause is a missing authorization check in the Customer Usage Provisioning Servlet, allowing an attacker to read statistical data such as p...

CVE-2021-27601: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS Java Applications based on HTMLB for Java allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting XSS vulnerability and the attacker can read and modify data. However, the attack...

PT-2021-17534 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA versions 7.31, 7.40, 7.50 Description: The issue allows an attacker to read statistical data, including product version, traffic, and timestamp, due to a missing authorization check in the Customer Usage Provisioning...

Vulnerabilities fixed in SAP Netweaver products

Several vulnerabilities have been fixed in SAP Netweaver products. By exploiting the vulnerabilities, a malicious party within the local network to bypass authentication, view sensitive information or cause cross-site scripting and Denial-of-Service. SAP has made updates available to address the...

PT-2021-14548

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Master Data Management versions 710 through 710.750 Description The issue allows a malicious unauthorized user with access to the MDM Server subnet to potentially find the password using a brute force method. If successful, the...

SAP Netweaver cross-site scripting vulnerabilities

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver AS JAVA versions 7.10 and 7.11. An attacker can...

PT-2021-17539 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 731, 740, 750 Description: The issue allows an attacker to cause a Denial of Service, affecting the Availability of the SAP system by blocking all work processes. This is achieved by calling the SPI WAIT MILLIS...

PT-2021-17537

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java affected versions not specified Description The issue allows a basic-level authorized attacker to store a malicious file on the server, which can lead to a Cross-Site Scripting XSS vulnerability when a victim attempts to...

PT-2021-14551

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java affected versions not specified Description The issue allows an unauthorized attacker to trick an administrator into invoking telnet commands on the SAP NetWeaver Application Server for Java, potential...

PT-2021-14558

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java HTTP Service versions 7.10 through 7.50 Description The issue arises from insufficient validation of logon groups in URLs, leading to a content spoofing issue when directory listing is enabled...