CVE-2018-2503: Missing Authorization

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

SAP NetWeaver Knowledge Management (XMLForms) XML External Entity Injection Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications. An XML external entity injection vulnerability exists in Knowledge Management XMLForms in SAP NetWeaver, which can be exploited by an attacker to gain...

SAP NetWeaver Open Redirect Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications. An open redirection vulnerability exists in SAP NetWeaver, which stems from the program failing to adequately validate URLs, and can be exploited by a...

CVE-2018-2476

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

CVE-2018-2477

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2018-2476

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

CVE-2018-2477

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

Design/Logic Flaw

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

Design/Logic Flaw

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2018-2477

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

CVE-2018-2477

CVE-2018-2477 affects SAP NetWeaver Knowledge Management (XMLForms) across versions 7.30, 7.31, 7.40 and 7.50. The root cause is insufficient validation of XML documents from untrusted sources, described in CNVD as an XML External Entity Injection vulnerability, with potential information disclos...

CVE-2018-2476

CVE-2018-2476 is a SAP NetWeaver open redirect vulnerability caused by insufficient URL validation in forums, affecting SAP NetWeaver versions 7.30, 7.31, and 7.40. The vulnerability enables redirection to a malicious site and requires user interaction to exploit. CVSS details in the record indic...

CVE-2018-2476

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

CVE-2018-2476: URL Redirection to Untrusted Site

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

CVE-2018-2477: XML Injection (aka Blind XPath Injection)

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

PT-2018-15593

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Knowledge Management XMLForms versions 7.30 through 7.50 Description The issue arises from insufficient validation of an XML document accepted from an untrusted source. This could potentially lead to security issues, but specific...

PT-2018-15592

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.30, 7.31, 7.40 Description The issue is due to insufficient URL validation in forums, allowing an attacker to redirect users to a malicious site. Recommendations For SAP NetWeaver version 7.30, update the URL validatio...

http-sap-netweaver-leak NSE Script

Detects SAP Netweaver Portal instances that allow anonymous access to the KM unit navigation page. This page leaks file names, ldap users, etc. SAP Netweaver Portal with the Knowledge Management Unit enable allows unauthenticated users to list file system directories through the URL...

org.apache.camel:camel-example-cxf-proxy (2.16.0), org.apache.camel:camel-sap-netweaver (2.16.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (2.16.0)

org.apache.camel:camel-http MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-example-cxf-proxy 2.16.0 - org.apache.camel:camel-sap-netweaver 2.16.0 Source cve...

org.apache.camel:camel-example-cxf-proxy (2.16.0), org.apache.camel:camel-sap-netweaver (2.16.0) potentially affected by CVE-2015-5348 via org.apache.camel:camel-http (2.16.0)

org.apache.camel:camel-http MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-http and may be impacted: - org.apache.camel:camel-example-cxf-proxy 2.16.0 - org.apache.camel:camel-sap-netweaver 2.16.0 Source cve...