5582 matches found
SAP NetWeaver SOAP RFC - CSRF
Application: SAP BASIS Vendor URL: http://www.sap.com Bugs: CSRF Exploits: YES Reported: 12.03.2011 Vendor response:13.03.2011 Date of SAP Security Note published: 14.08.2012 Date of Public Advisory:13.11.2012 Reference: SAP Security Note 1728500 Author: Alexey Tyurin ERPScan Description It is...
SAP NetWeaver J2EE MeSync信息泄露漏洞
SAP NetWeaver是SAP的集成技术平台和自从SAP Business Suite以来的所有SAP应用的技术基础。 SAP NetWeaver J2EE MeSync在实现上存在信息泄露漏洞，攻击者无需验证即可获取移动引擎版本和技术人员姓名等敏感信息。 SAP NetWeaver 厂商补丁： SAP --- SAP已经为此发布了一个安全公告（DSECRG-11-034）以及相应补丁: DSECRG-11-034：SAP NetWeaver J2EE MeSync – Information Disclose...
SAP NetWeaver身份验证绕过漏洞
SAP NetWeaver是SAP的集成技术平台和自从SAP Business Suite以来的所有SAP应用的技术基础。 SAP NetWeaver CTC服务在实现上存在身份验证绕过漏洞，可导致非法用户管理和OS命令执行。 SAP NetWeaver 厂商补丁： SAP --- SAP已经为此发布了一个安全公告（DSECRG-11-041）以及相应补丁: DSECRG-11-041：SAP NetWeaver – Authentication bypass Verb Tampering...
SAP NetWeaver multiple security vulnerabilities
Authentication bypass, crosste scripting, code injection, information leakage...
[DSECRG-11-038] SAP RSTXSCRP report - smb relay vulnerability
DSECRG-11-038 SAP RSTXSCRP report - smb relay vulnerability SAP RSTXSCRP Report has path traversal vulnerability which can lead to SMB relay attack and full control on system. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: Path traversal, SMBRelay...
[DSECRG-11-041] SAP NetWeaver - Authentication bypass (Verb Tampering)
DSECRG-11-041 SAP NetWeaver - Authentication bypass Verb Tampering Authentication bypass vulnerability in SAP NetWeaver CTC service can be exploited for unauthorized user management and OS command execution. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.co...
[DSECRG-11-037] SAP BW Doc - Multiple XSS
DSECRG-11-037 SAP BW Doc - Multiple XSS BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 14.03.2011 Vendor response: 16.03.2011 Date of Public Advisory: 11.11.20...
[DSECRG-11-030] SAP NetWeaver JavaMailExamples - XSS
SAP NetWeaver JavaMailExamples has linked XSS vulnerability. Digital Security Research Group DSecRG Advisory Internal DSecRG-00135 Application: SAP NetWeaver Versions Affected: SAP NetWeaver JavaMailExamples Vendor URL: http://www.SAP.com Bugs: XSS Exploits: YES Reported: 11.05.2010 Vendor...
[DSECRG-11-039] SAP NetWeaver TH_GREP module - Code injection vulnerability (NEW)
DSECRG-11-039 SAP NetWeaver THGREP module - Code injection vulnerability NEW THGREP report is vulnerable for command execution vulnerability which is working with previous patch note 1433101. Remote OS command execution is possible Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendo...
[DSECRG-11-040] SAP NetWeaver SPML - XML CSRF user creation
DSECRG-11-040 SAP NetWeaver SPML - XML CSRF user creation Attacker can create a new user in J2EE Engine using CSRF attack on SPML service. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: CSRF Reported: 14.03.2011 Vendor response: 15.03.2011 Date of...
[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose
DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...
[DSECRG-11-031] SAP RFC EPS_DELETE_FILE - Authorisation bypass, smbrelay
DSECRG-11-031 SAP RFC EPSDELETEFILE - Authorisation bypass, smbrelay Security vulnerability was founded in sap EPSDELETEFILE RFC function allows attacker to delete files remotely or steal hashes of SAP server account in windows environment using SMBRelay attack. Digital Security Research Group...
[DSECRG-11-034] SAP NetWeaver J2EE MeSync – information disclose
DSECRG-11-034 SAP NetWeaver J2EE MeSync – information disclose Attacker can get information about mobile engine version and sometimes the name of the technical user. Application: SAP NetWeaver Versions Affected: SAP NetWeaver MI 2 Vendor URL: http://www.SAP.com Bugs: information disclosure...
[DSECRG-11-036] SAP NetWaver Virus Scan Interface - multiple XSS
DSECRG-11-036 SAP NetWaver Virus Scan Interface - multiple XSS SAP Netweaver Virus Scan Interface has linked XSS vulnerabilities. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 01.04.2010 Vendor response: 08.04.2010 Date of Public...
SAP NetWeaver BW Doc Cross Site Scripting
DSECRG-11-037 SAP BW Doc - Multiple XSS BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 14.03.2011 Vendor response: 16.03.2011 Date of Public Advisory: 11.11.20...
[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose (by ERPScan)
DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...
SAP NetWeaver Business Communication Broker - multiple XSS
Application: SAP NetWeaver Vendor URL: Bugs: Multiple XSS Risk: High Exploits: YES Reported: 09.12.2011 Vendor response: 10.12.2011 Date of Public Advisory: 20.01.2012 Reference: SAP Security Note 1585652 Description SAP NetWeaver Business Communication Broker has multiple linked XSS vulnerabilie...
SAP NetWeaver Exportability Check Service - unauthorized directory traversal
Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver J2EE Vendor URL: http://www.sap.com Bugs:Directory Traversal, File Read Exploits: YES Reported: 19.08.2011 Vendor response: 20.08.2011 Date of SAP Security Note Published: 08.01.2013 Date of Public Advisory: 28.01.2013 Reference: SA...
SAP NetWeaver Portal - Directory Traversal
Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal Vendor URL: http://www.sap.com Bugs:Directory Traversal Exploits: YES Reported: 08.08.2011 Vendor response:10.08.2011 Date of Public Advisory:13.03.2012 Reference: SAP Security Note 1630293 Author:Dmitriy Chastuchin ERPScan...
SAP NetWeaver Internet Sales-Multiple XSS - 2
Application: SAP NetWeaver Vendor URL: Bugs: XSS Risk: Medium Exploits: YES Reported: 08.04.2011 Vendor response: 10.04.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1584030 Author: Dmitriy Chastuchin ERPScan Description SAP NetWeaver Internet...