SAP NetWeaver Information Disclosure Vulnerability (CNVD-2017-14354)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver, which can be exploited by attackers to obtain...

SAP Netweaver Authentication and SSO Cross-Site Scripting Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP Netweaver authentication and SSO due to the program not...

SAP NetWeaver Generic Object Services Cross-Site Scripting Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP Netweaver that originates from the program not properly...

SAP Netweaver ABAP EA-DFPS Utility Authentication Bypass Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A utility authentication bypass vulnerability exists in SAP Netweaver ABAP EA-DFPS. An attacker could exploit th...

SAP Netweaver ABAP EA-DFPS Remote Authentication Bypass Vulnerability (CNVD-2017-10684)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An authentication bypass vulnerability exists in SAP Netweaver ABAP. An attacker could exploit this vulnerabilit...

SAP NetWeaver Denial of Service Vulnerability (CNVD-2017-09949)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A denial of service vulnerability exists in SAP Netweaver. An attacker could exploit this vulnerability to cause...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

CVE-2017-8913

The CVE-2017-8913 vulnerability affects SAP NetWeaver AS JAVA 7.5, specifically the Visual Composer VC70RUNTIME component. Affected files/components include VC70RUNTIME (7.30–7.50) and VCFRAMEWORK/VCFLEX7.00 as listed in public advisories. The issue is an XML External Entity (XXE) vulnerability t...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

SAP NetWeaver AS Java ES UDDI SQL Injection Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications. SAP NetWeaver AS Application Server Java is an application server that runs in NetWeaver and is based on the Java programming language. ES UDDI i...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

RCE via path Traversal using CSRF in SAP CRM

Application: SAP NetWeaver Versions Affected: SAP CRM 13676083 Vendor URL: SAP Bugs: CSRF, Path Traversal Reported: 05.10.2017 Vendor response: 06.10.2017 Date of Public Advisory: 13.02.2018 Reference: SAP Security Note 2547431 Author: Vahagn Vardanyan ERPScan, Vladimir Egorov ERPScan VULNERABILI...

HANA server memory disclosure

Application: SAP NetWeaver Versions Affected: SAP HANA 1.0, 2.0 all versions Vendor URL: SAP Bugs: Information Disclosure Reported: 05.10.2017 Vendor response: 06.10.2017 Date of Public Advisory: 13.02.2018 Reference: SAP Security Note 2572940 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATIO...

SAP Java P4 SLD SSRF

Application: SAP NetWeaver Versions Affected: SAP Netweaver 7.4, 7.5 Vendor URL: SAP Bug: SSRF Reported: 05.10.2017 Vendor response: 06.10.2017 Date of Public Advisory: 13.02.2018 Reference: SAP Security Note 2565622 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: Missing...

CVE-2017-7717

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7717

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

Sql injection

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7717

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7717

The CVE-2017-7717 entry concerns SAP NetWeaver AS Java 7.4, specifically the ES UDDI component. The vulnerability arises in the getUserUddiElements method, described as an SQL injection that permits remote authenticated users to execute arbitrary SQL commands via unspecified vectors. This is supp...

SAP NetWeaver TREX and BWA Remote Code Execution Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A remote code execution vulnerability exists in SAP NetWeaver TREX and BWA, which can be exploited by attackers ...