SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection Vulnerability

Exploit for windows platform in category remote exploits Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTCREFRESHCHECKENV 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system...

CVE-2016-7435: Undefined Security Weakness

The 1 SCTCREFRESHEXPORTTABCOMP, 2 SCTCREFRESHCHECKENV, and 3 SCTCTMSMAINTAINALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security...

SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection Vulnerability

Exploit for windows platform in category remote exploits Onapsis Security Advisory ONAPSIS-2016-043: SAP OS Command Injection in SCTCTMSMAINTAINALOG 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system...

SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection

Onapsis Security Advisory ONAPSIS-2016-043: SAP OS Command Injection in SCTCTMSMAINTAINALOG 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system. Risk Level: Critical 2. Advisory Information...

SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection

Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTCREFRESHEXPORTTABCOMP 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system. Risk Level: Critical 2. Advisory Information...

SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection

Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTCREFRESHCHECKENV 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system. Risk Level: Critical 2. Advisory Information...

SAP Solman Information Disclosure Vulnerability

SAP NetWeaver Application Server AS Java is an application server that runs in NetWeaver and is based on the Java programming language.SolMan is not just for SAP components, but also includes complete customer solutions. An information disclosure vulnerability exists in SAP Solman. This...

PT-2016-24

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the TranslationSupport component of the SAP NetWeaver integration platform, which is affected by incorrect restriction of XML links to external objects. This can...

PT-2016-20

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the FloorPlanApp component of the SAP NetWeaver platform, which has a problem with improper restriction of XML external entity references. This could allow a...

PT-2016-15

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the /com.sap.portal.design.datamigration.LogPortalComponent component of the SAP NetWeaver platform, which is vulnerable due to insufficient protection of the we...

PT-2016-19

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to insufficient data protection in the MembersApp component of the SAP NetWeaver platform. It allows a remote attacker to disclose user information, such as listing...

PT-2016-27

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue exists due to insufficient data sanitization when copying data from requests to responses in the DownloadServlet component of the SAP NetWeaver integration platform. This coul...

PT-2016-26

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the YWorksLayouter component of the SAP NetWeaver platform, which has a problem with improper restriction of XML external entity references. This could allow a...

PT-2016-18

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue exists due to incorrect restriction of the directory path name with limited access in the Log Viewer component of the SAP NetWeaver platform. This allows an attacker to bypass...

PT-2016-23

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the /com.sapportals.navigation.testComponent.NavigationRequestSniffer component of the SAP NetWeaver platform, which is vulnerable due to the lack of protection...

PT-2016-25

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to a component that checks hidden content in the SAP NetWeaver platform, which has an incorrect restriction on XML links to external objects. This can be exploited ...

PT-2016-21

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue exists due to insufficient protection of the web page structure, allowing for reflected cross-site scripting. This could enable a remote attacker to inject arbitrary HTML tags...

PT-2016-17

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the /com.sap.portal.themes.styleservice.LockingTestPortalComponent component of the SAP NetWeaver platform, which is vulnerable due to insufficient protection of...

PT-2016-22

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the incorrect restriction of XML links to external objects in a component of the SAP NetWeaver platform. This could allow a remote attacker to gain access to...

PT-2016-16

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue arises from insufficient cleaning of user-input data when it is displayed on the log view page, specifically affecting the UpdateThemeVersionPortalComponent. This could allow ...