5332 matches found
CVE-2012-1290
The CVE-2012-1290 entry describes a Cross-site scripting (XSS) vulnerability in SAP NetWeaver 7.0, specifically in the Internet Sales (crm.b2b) module and the b2b/auction/container.jsp page. The issue is exploitable via the _loadPage parameter, allowing an attacker to inject arbitrary web script ...
CVE-2012-1289: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to 1 b2b/admin/log.jsp or 2 b2b/admin/logview.jsp in the Internet Sales crm.b2b component, or 3 ipc/admin/log.jsp or 4...
CVE-2012-1291: Undefined Security Weakness
Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servletjsp service...
SAP NetWeaver多个输入验证漏洞
BUGTRAQ ID: 52101 SAP NetWeaver是SAP的集成技术平台和自从SAP Business Suite以来的所有SAP应用的技术基础。 SAP NetWeaver在实现上存在XSS、目录遍历、信息泄露漏洞，攻击者可利用这些漏洞执行任意脚本代码、窃取信息。 0 SAP NetWeaver 7.0 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sap.com/platform/netweaver/index.epx...
CVE-2012-1292: Undefined Security Weakness
Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors...
CVE-2012-1290: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in b2b/auction/container.jsp in the Internet Sales crm.b2b module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the loadPage parameter...
CVE-2011-4707
Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...
CVE-2011-4707
CVE-2011-4707 involves multiple cross-site scripting (XSS) vulnerabilities in the SAP NetWeaver Virus Scan Interface. The flaws allow remote attackers to inject arbitrary web script or HTML via the following parameters: (1) instname to VsiTestScan servlet and (2) name to VsiTestServlet servlet. A...
CVE-2011-4707
Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...
CVE-2011-4707: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...
SAP NetWeaver SOAP RFC - CSRF
Application: SAP BASIS Vendor URL: http://www.sap.com Bugs: CSRF Exploits: YES Reported: 12.03.2011 Vendor response:13.03.2011 Date of SAP Security Note published: 14.08.2012 Date of Public Advisory:13.11.2012 Reference: SAP Security Note 1728500 Author: Alexey Tyurin ERPScan Description It is...
SAP NetWeaver J2EE MeSync信息泄露漏洞
SAP NetWeaver是SAP的集成技术平台和自从SAP Business Suite以来的所有SAP应用的技术基础。 SAP NetWeaver J2EE MeSync在实现上存在信息泄露漏洞，攻击者无需验证即可获取移动引擎版本和技术人员姓名等敏感信息。 SAP NetWeaver 厂商补丁： SAP --- SAP已经为此发布了一个安全公告（DSECRG-11-034）以及相应补丁: DSECRG-11-034：SAP NetWeaver J2EE MeSync – Information Disclose...
SAP NetWeaver身份验证绕过漏洞
SAP NetWeaver是SAP的集成技术平台和自从SAP Business Suite以来的所有SAP应用的技术基础。 SAP NetWeaver CTC服务在实现上存在身份验证绕过漏洞，可导致非法用户管理和OS命令执行。 SAP NetWeaver 厂商补丁： SAP --- SAP已经为此发布了一个安全公告（DSECRG-11-041）以及相应补丁: DSECRG-11-041：SAP NetWeaver – Authentication bypass Verb Tampering...
[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose
DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...
[DSECRG-11-038] SAP RSTXSCRP report - smb relay vulnerability
DSECRG-11-038 SAP RSTXSCRP report - smb relay vulnerability SAP RSTXSCRP Report has path traversal vulnerability which can lead to SMB relay attack and full control on system. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: Path traversal, SMBRelay...
[DSECRG-11-040] SAP NetWeaver SPML - XML CSRF user creation
DSECRG-11-040 SAP NetWeaver SPML - XML CSRF user creation Attacker can create a new user in J2EE Engine using CSRF attack on SPML service. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: CSRF Reported: 14.03.2011 Vendor response: 15.03.2011 Date of...
[DSECRG-11-030] SAP NetWeaver JavaMailExamples - XSS
SAP NetWeaver JavaMailExamples has linked XSS vulnerability. Digital Security Research Group DSecRG Advisory Internal DSecRG-00135 Application: SAP NetWeaver Versions Affected: SAP NetWeaver JavaMailExamples Vendor URL: http://www.SAP.com Bugs: XSS Exploits: YES Reported: 11.05.2010 Vendor...
[DSECRG-11-041] SAP NetWeaver - Authentication bypass (Verb Tampering)
DSECRG-11-041 SAP NetWeaver - Authentication bypass Verb Tampering Authentication bypass vulnerability in SAP NetWeaver CTC service can be exploited for unauthorized user management and OS command execution. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.co...
[DSECRG-11-039] SAP NetWeaver TH_GREP module - Code injection vulnerability (NEW)
DSECRG-11-039 SAP NetWeaver THGREP module - Code injection vulnerability NEW THGREP report is vulnerable for command execution vulnerability which is working with previous patch note 1433101. Remote OS command execution is possible Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendo...