CVE-2018-2363

SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by...

CVE-2018-2363

SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by...

Unspecified Vulnerability in SAP BASIS SAP Note Assistant

SAP BASIS is Germany SAP SAP company engaged in sap system management of a role, mainly responsible for sap system planning, installation, configuration, monitoring, maintenance, tuning, etc. SAP Note Assistant is one of the Note problem-solving aids. Mainly responsible for sap system planning,...

CVE-2017-16691

SAP Note Assistant tool SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52 supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible...

CVE-2017-16682

SAP NetWeaver Internet Transaction Server ITS, SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application...

CVE-2017-16691

Summary (CVE-2017-16691) : A vulnerability in SAP Note Assistant (part of SAP BASIS releases 7.00–7.02, 7.10–7.11, 7.30, 7.31, 7.40, 7.50–7.52) arises from insecure signature validation of SAP Notes archives. During SAR handling, signature verification is coupled with extraction via SAPCAR, which...

CVE-2013-3063

SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

CVE-2013-3063

SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

SAP Netweaver XRFC — Stack Overflow

Application: SAP BASIS Versions Affected: SAP XRFC 6.40/7.00 may be others Vendor URL: Bugs: Stack Overflow Exploits: YES DoS PoC Reported: 29.03.2010 Vendor response: 29.03.2010 Date of Public Advisory: 09.11.2010 Author: Alexey Sintsov Description It is possible to call stack overflow via RFC...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the SAP Internet Communication Framework BC-MID-ICF in the SAP Basis component 700 before SP12, and 640 before SP20, allow remote attackers to inject arbitrary web script or HTML via certain parameters associated with the default login error pa...

SAP Internet Communication Framework (BC-MID-ICF) Vulnerability

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: Internet Communication Framework BC-MID-ICF Vendor: SAP Subject: Multiple XSS, HTML Injection Risk: High Effect: Remotely exploitable Author: Cyrill Brunschwiler [email protected] Date: June, 17th 2007 Introduction: -------------...

PHP-Nuke Book Catalog Module Upload.PHP任意文件上传漏洞

PHP-Nuke Book Catalog Module是一款PHP的图书目录模块。 PHP-Nuke Book Catalog Module不正确过滤用户提交的数据，远程攻击者可以利用漏洞上传任意文件，并以WEB进程执行。 'BookCatalog/upload.php'对用户提交的图象文件缺少正确过滤，可直接提交PHP文件而导致以WEB权限执行。 SAP Basis Community Book Catalog Module 1.0 目前没有解决方案提供,请关注以下链接： http://www.basisconsultant.com/index.php...