CVE-2021-21489

SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-Site Scripting XSS vulnerability. This would allow an attacker with administrative privileges to store a malicious script on the portal. T...

CVE-2021-37531

SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be...

CVE-2021-37531

SAP NetWeaver Knowledge Management XML Forms (versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50) is affected by an XSLT processing vulnerability that allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet containing OS-level commands, place it where the system can access...

PT-2021-4347 · Sap · Sap Netweaver Application Server Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java JMS Connector Service versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description: The issue is related to the JMS Connector Service in SAP NetWeaver Java Application Server, where there are shortcomings in t...

SAP NetWeaver Application Server Java 授权问题漏洞

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used for developing and running Java EE applications. An authorization issue vulnerability exists in SAP NetWeaver Application Server Java version...

PT-2021-6147 · Sap · Sap Netweaver Development Infrastructure Component Build Service

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Development Infrastructure Component Build Service versions 7.11 through 7.50 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in the SAP NetWeaver Development Infrastructure Component Build...

CVE-2021-33702

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets...

Code injection

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity...

CVE-2021-33707

SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity...

SAP Netweaver 跨站脚本漏洞

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP Netweaver, which can be exploited by an attacker to craft a...

SAP NetWeaver 跨站脚本漏洞

SAP NetWeaver Development Infrastructure is a SAP company that provides a consistent development environment, development teams, and support for software development throughout the product lifecycle. A cross-site scripting vulnerability exists in SAP NetWeaver Development Infrastructure, which...

SAP NetWeaver AS ABAP Memory Corruption (July 2021)

A memory corruption vulnerability exists in SAP NetWeaver AS ABAP due to buffer overflow from RFC Requests. An unauthenticated, remote attacker can exploit this by sending overlong content, crashing the corresponding work process. Note that Nessus has not tested for this issue but has instead...

SAP NetWeaver AS Missing Authorization Check (3059446)

A missing authorization check vulnerability exists in the Administration Workset of the SAP NetWeaver Guided Procedures versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. An authenticated, remote attacker can exploit this, to escalate privileges and allow an unauthorized user the ability to...

SAP NetWeaver Input Validation Error Vulnerability (CNVD-2021-54403)

SAP Netweaver is a service oriented, integrated application platform from SAP Germany that provides a development and runtime environment for SAP applications. The platform provides a development and runtime environment for SAP applications.SAP NetWeaver suffers from an input validation error...

SAP Netweaver Input Validation Error Vulnerability (CNVD-2021-54402)

SAP Netweaver is a service oriented, integrated application platform from SAP Germany that provides a development and runtime environment for SAP applications. SAP Netweaver is vulnerable to an input validation error that results from a network system or product that does not properly validate da...

SAP NetWeaver AS ABAP Code Injection (3048657)

A code injection vulnerability exists in SAP NetWeaver Application Server ABAP Reconciliation Framework. ABAP Server and ABAP Platform may allow a high privileged attacker to inject code that can be executed by the application. An attacker could potentially delete critical information and make th...

SAP NetWeaver AS ABAP and ABAP Information Disclosure (3044754)

An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP. ABAP Server and ABAP Platform may expose functions externally that can lead to an information disclosure. Note that Nessus has not tested for this issue but has instead relied only on the application's...

The vulnerability of the SAP NetWeaver integration platform, related to the lack of measures taken to protect the structure of the web page, allows a hacker to intercept the session of administrators or users of web resources.

The vulnerability of the Ecatt server, a software integration platform for SAP NetWeaver, is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the session of...

The vulnerability of the SAP NetWeaver integration platform, related to the lack of measures taken to protect the structure of the web page, allows a hacker to intercept the session of administrators or users of web resources.

The vulnerability of the ProxyServer server of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the session of administrators ...

SAP NetWeaver AS for Java DoS (3056652)

SAP NetWeaver AS for Java Http Service Monitoring Filter, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitimate users leading to deni...