CVE-2018-2434: Insufficient Verification of Data Authenticity

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver UIInfra, 1.0, SAP UI Implementation for Decoupled Innovations UI700, 2.0: SAP NetWeaver 7.00 Implementation,...

PT-2018-15558

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.00, 7.4, 7.5, 7.51, 7.52 UI add-on for SAP NetWeaver version 1.0 SAP UI Implementation for Decoupled Innovations version 2.0 Description A content spoofing issue in certain SAP components allows rendering of HTML pages...

Design/Logic Flaw

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...

Design/Logic Flaw

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

CVE-2018-2428

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

CVE-2018-2424

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...

CVE-2018-2428

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

PT-2018-15551

Name of the Vulnerable Software and Affected Versions SAP Hana Database versions 1.00 through 2.00 SAP UI5 version 1.00 SAP UI5 Java versions 7.30 through 7.50 SAP UI versions 7.40 through 7.52 SAP UI for SAP NetWeaver version 2.0 Description The issue arises from the failure to validate user inp...

PT-2018-15554

Name of the Vulnerable Software and Affected Versions SAP UI5 Handler versions 7.4 through 7.52 SAP Infrastructure version 1.0 SAP UI for SAP NetWeaver version 2.0 Description The issue allows an attacker to access restricted information under certain conditions. Recommendations For SAP UI5 Handl...

CVE-2018-2428: Undefined Security Weakness

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

CVE-2018-2424: Improper Input Validation

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...

SAP NetWeaver AS Java Log Injection Security Bypass Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide the development and operation environment for SAP applications. SAP NetWeaver AS Application Server Java is a run in NetWeaver and based on the Java programming language...

SAP NetWeaver Instance Agent Service Information Disclosure Vulnerability (CNVD-2018-15773)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver. An attacker could exploit this vulnerability to...

Unspecified Content Spoofing Vulnerability in SAP NetWeaver Application Server Java Web Container and HTTP Service

SAP NetWeaver is Germany's SAP SAP company's set of service-oriented integrated application platform, the platform can provide development and operation environment for SAP applications. Application Server Java Web Container is one of the Java application running environment; HTTP Service is an...

SAP NetWeaver Open Redirect Vulnerability (CNVD-2018-14851)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An open redirection vulnerability exists in SAP NetWeaver. An attacker can exploit the vulnerability to cause a...

SAP Netweaver Web Dynpro ABAP Denial of Service Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A denial of service vulnerability exists in SAP Netweaver Web Dynpro ABAP. An attacker could exploit this...

SAP NetWeaver suffers from unspecified SQL injection vulnerability (CNVD-2018-14849)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. SAP NetWeaver suffers from an unspecified SQL injection vulnerability that arises from failure to adequately...

SAP NetWeaver Instance Agent Service Memory Corruption Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A memory corruption vulnerability exists in the SAP NetWeaver Instance Agent Service. An attacker could exploit...

SAP NetWeaver Mobile Client Information Disclosure Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver Mobile Client. An attacker could exploit this...

SAP NetWeaver Open Redirect Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An open redirection vulnerability exists in SAP NetWeaver. An attacker can exploit the vulnerability by executin...