CVE-2020-6323

The CVE-2020-6323 entry describes a Cross-Site Scripting vulnerability in SAP NetWeaver Enterprise Portal (Fiori Framework Page) for versions 7.50, 7.31, and 7.40. The underlying issue is inadequate encoding of user-controlled inputs, allowing an attacker with a valid session to craft input that ...

CVE-2020-6323

SAP NetWeaver Enterprise Portal Fiori Framework Page versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the...

PT-2020-19093

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 Description The issue allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols, which are otherwis...

CVE-2020-6319: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal...

CVE-2020-6323: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal Fiori Framework Page versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the...

PT-2020-19138

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java versions 7.10 through 7.50 Description The issue allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. This could be used to execute phishin...

PT-2020-19097

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal Fiori Framework Page versions 7.31, 7.40, 7.50 Description The issue arises from insufficient encoding of user-controlled inputs, allowing an attacker with a valid session to create a Cross Site Scripting XSS...

CVE-2020-6371: Undefined Security Weakness

User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP POWL test application versions - 710, 711, 730, 731, 740, 750, leading to Information Disclosure...

PT-2020-19144 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP POWL test application versions 710 through 750 Description: The issue allows for user enumeration, potentially exposing a list of user accounts and personal user information, leading to Information...

CVE-2020-6365: URL Redirection to Untrusted Site

SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. The attacker could execute phishing attacks to steal credentials of the...

SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2020-52934)

SAP NetWeaver is an integrated application platform based on professional standards that dramatically reduces the complexity of system integration. Its components include portals, application servers, business intelligence solutions as well as system integration and data integration technologies....

SAP NetWeaver AS ABAP Business Server Cross-Site Scripting Vulnerability (CNVD-2020-52936)

SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP Business Server Pages. The vulnerability stems from a lack of proper validation of client-side...

SAP NetWeaver Application Server Java Cross-Site Scripting Vulnerability

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server Java XML Forms versions 7.30, 7.31, 7.40, 7.50, which arises from a lack of proper validation of client-side data in the web application. An...

SAP NetWeaver AS ABAP Cross-Site Scripting Vulnerability

SAP Netweaver is an integrated, service-oriented application platform. ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP, which can be exploited by remote attackers to...

SAP NetWeaver AS Java Multiple XSS (2953112)

The version of SAP NetWeaver AS Java detected on the remote host may be affected by multiple cross-site scripting vulnerabilities, as follows: - SAP NetWeaver Application Server JAVA XML Forms versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an...

CVE-2020-6324

SAP Netweaver AS ABAPBSP Test Application sbspexttable, version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the victim clicks on this URL, the attacker can read, modify the information available in the victim�s brows...

Cross site scripting

SAP Netweaver AS ABAPBSP Test Application sbspexttable, version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the victim clicks on this URL, the attacker can read, modify the information available in the victim?s brows...

CVE-2020-6324

SAP Netweaver AS ABAPBSP Test Application sbspexttable, version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the victim clicks on this URL, the attacker can read, modify the information available in the victim�s brows...

CVE-2020-6326

SAP NetWeaver Knowledge Management, version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting...

CVE-2020-6326

SAP NetWeaver Knowledge Management, version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting...