CVE-2017-12637: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657...

PT-2017-12616

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java version 7.5 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. dot dot in the query string. This issue has been exploited in the wild...

CVE-2010-5326: Missing Authentication for Critical Function

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack...

PT-2016-3365

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions prior to 7.3 Description The issue is related to the Invoker Servlet component of the SAP NetWeaver Java Application Server, which has weaknesses in its authentication procedure. This can be...

CVE-2009-2932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server Java 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field...