5636 matches found
Authentication flaw
Under certain conditions SAP NetWeaver Application Server for Java Startup Framework, versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted...
CVE-2019-0328
CVE-2019-0328 affects SAP NetWeaver Process Integration’s ABAP Tests Modules across SAP Basis versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5. The root cause is improper handling when constructing external OS commands from input data, allowing an attacker to execute OS commands with privileged rights. Con...
CVE-2019-0327
This CVE affects SAP NetWeaver for Java Application Server Web Container. The vulnerability allows an attacker to upload files (including script files) due to inadequate file format validation in engineapi (versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5) and servercode (versions 7.2, 7.3, 7.31, 7.4, 7.5)...
CVE-2019-0327
SAP NetWeaver for Java Application Server - Web Container, engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5, servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5, allows an attacker to upload files including script files without proper file format validation...
CVE-2019-0318
Under certain conditions SAP NetWeaver Application Server for Java Startup Framework, versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted...
CVE-2019-0318
CVE-2019-0318 affects SAP NetWeaver Application Server for Java (Startup Framework) versions 7.21, 7.22, 7.45, 7.49 and 7.53. Under certain conditions, an attacker can access information that would be restricted (information disclosure). The Connected documents reiterate the same affected product...
PT-2019-3772
Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration versions 7.0 through 7.5 Description The issue allows an attacker to execute OS commands with privileged rights, potentially impacting the integrity and availability of the system. This is due to the lack of...
CVE-2019-0327: Unrestricted Upload of File with Dangerous Type
SAP NetWeaver for Java Application Server - Web Container, engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5, servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5, allows an attacker to upload files including script files without proper file format validation...
CVE-2019-0328: Improper Neutralization of Special Elements used in an OS Command
ABAP Tests Modules SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5 of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system...
CVE-2019-0318: Undefined Security Weakness
Under certain conditions SAP NetWeaver Application Server for Java Startup Framework, versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted...
PT-2019-4586
Name of the Vulnerable Software and Affected Versions SAP NetWeaver for Java Application Server - Web Container versions 7.1 through 7.5 Description The issue allows an attacker to upload files, including script files, without proper file format validation. This can be exploited by a remote...
PT-2019-4584
Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for Java Startup Framework versions 7.21, 7.22, 7.45, 7.49, and 7.53 Description The issue is related to the lack of protection for internal data in the Startup Framework component of the SAP NetWeaver...
Cross site scripting
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scrip...
CVE-2019-0316
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scrip...
CVE-2019-0316
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scrip...
CVE-2019-0316
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scrip...
CVE-2019-0316
CVE-2019-0316 affects SAP NetWeaver Process Integration. The vulnerability arises from insufficient validation of user-controlled inputs in specific servlets, enabling a reflected Cross-Site Scripting (XSS) attack. An attacker with admin privileges can inject malicious scripts that are executed i...
PT-2019-4578
Name of the Vulnerable Software and Affected Versions SAP NetWeaver Process Integration versions 7.10 through 7.11 SAP NetWeaver Process Integration version 7.20 SAP NetWeaver Process Integration version 7.30 SAP NetWeaver Process Integration version 7.31 SAP NetWeaver Process Integration version...
CVE-2019-0316: Improper Neutralization of Input During Web Page Generation
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scrip...
SAP NetWeaver Process Integration Clickjacking Vulnerability
SAP NetWeaver Process Integration PI is an SAP enterprise application integration software from SAP, Germany, and is a component of the NetWeaver product group. The component is mainly used for the exchange of information between the internal system and the external. A clickjacking vulnerability...