SAP NetWeaver HostControl Command Injection

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ This module is based...

SAP NetWeaver AS Java CIM UPLOAD - XXE

Application: SAP NetWeaver AS Java Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 16.06.2014 Vendor response: 17.06.2014 Date of Public Advisory: 18.05.2015 Reference: SAP Security Note 2090851 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XML External...

SAP NetWeaver AS Java - XXE

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java Vendor URL: http://www.sap.com Bugs: XXE Reported: 16.06.2014 Vendor response: 17.06.2014 Date of Public Advisory: 17.10.2014 Reference: SAP Security Note 2045176 Authors: Vahagn Vardanyan ERPScan Description SAP XML pars...

CVE-2014-4160

Multiple cross-site scripting XSS vulnerabilities in the testcanvas node in SAP NetWeaver Business Client NWBC allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 sap-accessibility parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the testcanvas node in SAP NetWeaver Business Client NWBC allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 sap-accessibility parameter...

CVE-2014-4160

Multiple cross-site scripting XSS vulnerabilities in the testcanvas node in SAP NetWeaver Business Client NWBC allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 sap-accessibility parameter...

CVE-2014-4160: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the testcanvas node in SAP NetWeaver Business Client NWBC allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 sap-accessibility parameter...

SAP NetWeaver Portal ReportXmlViewer - XXE

Application: SAP NetWeaver Portal 7.31.201109172004 Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2111939 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

SAP NetWeaver Portal XMLValidationComponent - XXE

Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal 7.31.201109172004 Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.02.2015 Reference: SAP Security Note 2093966 Authors: Vahagn Vardanyan...

SAP Management Console ReadProfile Parameters - Information disclosure

Application: SAP NetWeaver 7.40 Vendor URL: http://www.sap.com Bugs: Information disclosure Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2091768 Authors: Dmitry Chastukhin ERPScan VULNERABILITY INFORMATION Class: Information...

CVE-2014-4003

The System Landscape Directory SLD in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system...

Information disclosure

The System Landscape Directory SLD in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system...

CVE-2014-4003

CVE-2014-4003 refers to the SAP NetWeaver System Landscape Directory (SLD) vulnerability where remote attackers can modify information through vectors related to adding a system. The core impact is information tampering with SLD data, as described in multiple sources (NVD entry and SAP-related ad...

CVE-2014-4003

The System Landscape Directory SLD in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system...

CVE-2014-4003: Undefined Security Weakness

The System Landscape Directory SLD in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system...

PT-2014-5665

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue in the System Landscape Directory SLD of SAP NetWeaver enables remote attackers to modify information. This is achieved through vectors related to adding a system...

SAP NetWeaver - Hardcoded credentials

Application: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Hardcoded credentials Reported: 06.03.2014 Vendor response: 07.03.2014 Date of Public Advisory: 15.06.2015 Reference: SAP Security Note 2059659 Authors: Rustem Gazizov, Diana Grigorieva ERPScan VULNERABILITY INFORMATION Class:...

SAP NetWeaver - Hardcoded Credentials

Application: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Hardcoded credentials Reported: 06.03.2014 Vendor response: 07.03.2014 Date of Public Advisory: 15.06.2015 Reference: SAP Security Note 2057982 Authors: Rustem Gazizov, Diana Grigorieva ERPScan VULNERABILITY INFORMATION Class:...

SAP NetWeaver Dispatcher Multiple Vulnerabilities - RCE, DoS

Application: SAP NetWeaver Dispatcher Versions Affected: SAP KERNEL 7.00 32BIT, disp+work.exe 7000.52.12.34966 Vendor URL: http://www.sap.com Bugs: Buffer overflow CWE-119, Integer overflow CWE-190, Improper Input Validation CWE-20 CVSS: AV:N/AC:H/Au:S/C:C/I:C/A:C 7.1 Exploits: PoC Reported:...