CVE-2024-45283: Plaintext Storage of a Password

SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successful exploitation, an attacker can read the sensitive information but cannot modify or delete the data...

PT-2024-31536

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for Java affected versions not specified Description The issue allows an authorized attacker to obtain sensitive information. The attacker could obtain the username and password when creating an RFC destination. After successf...

CVE-2024-22126: Improper Neutralization of Input During Web Page Generation

The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting XSS vulnerability, leading to a high impact on confidentiality and...

CVE-2023-31405: Improper Output Neutralization for Logs

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any...

CVE-2023-23857: Improper Authentication

Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services...

CVE-2023-0017: Improper Access Control

An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current...

SAP NetWeaver AS for Java DoS (3056652)

SAP NetWeaver AS for Java Http Service Monitoring Filter, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to deni...

CVE-2021-33670: Undefined Security Weakness

SAP NetWeaver AS for Java Http Service Monitoring Filter, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to deni...

PT-2021-20248

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java versions 7.10 through 7.50 Description: The issue allows an attacker to send multiple HTTP requests with different method types, thereby crashing the filter and making the HTTP server unavailable to other legitimate...

CVE-2021-27635: Improper Restriction of XML External Entity Reference

SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator to connect over a network and submit a specially crafted XML file in the application because of missing XML Validation, this vulnerability enables attacker to fully compromise...

PT-2021-17570

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for JAVA versions 7.20, 7.30, 7.31, 7.40, 7.50 Description The issue allows an attacker, authenticated as an administrator, to submit a specially crafted XML file due to missing XML validation. This enables the attacker to ful...