3373 matches found
SAP NetWeaver AS JAVA CRM Log Injection Remote Command Execution
!/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning helpdesc = ''' PoC of Remote Command Execution via Log...
SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution
SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution !/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning...
CVE-2018-2365
SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...
CVE-2018-2368
SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity...
CVE-2018-2365
SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...
Authentication flaw
SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity...
CVE-2018-2368
SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity...
The vulnerability of the FloorPlanApp component, a software integration platform of SAP NetWeaver, allows a perpetrator to access confidential information or cause service failures.
The vulnerability of the FloorPlanApp component of the SAP NetWeaver software integration platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information or cause service...
The vulnerability of the UpdateThemeVersionPortalComponent component in the SAP NetWeaver software integration platform allows a hacker to execute arbitrary JavaScript code on the client side.
The vulnerability of the UpdateThemeVersionPortalComponent component in the SAP NetWeaver software integration platform exists due to insufficient cleaning of data entered by users when they are displayed on the journal viewing page. Exploiting this vulnerability allows a malicious actor to execu...
The vulnerability of the hidden content checking component in the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.
The vulnerability of the hidden content checking component in the SAP NetWeaver software integration platform is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information or caus...
The vulnerability of the TranslationSupport component of the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.
The vulnerability of the TranslationSupport component in the SAP NetWeaver software integration platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information or cause servic...
The vulnerability of the YWorksLayouter component of the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.
The vulnerability of the YWorksLayouter component of the SAP NetWeaver software integration platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information or cause service...
The vulnerability of the hidden content checking component in the SAP NetWeaver software integration platform allows a perpetrator to access confidential information or cause service failures.
The vulnerability of the hidden content checking component in the SAP NetWeaver software integration platform is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information or cause servic...
The vulnerability of the DownloadServlet component in the SAP NetWeaver software integration platform allows a hacker to execute arbitrary JavaScript code on the client side.
The vulnerability of the DownloadServlet component in the SAP NetWeaver software integration platform exists due to insufficient data cleaning during the copying of requests into responses. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code on the client...
CVE-2018-2371
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...
CVE-2018-2371
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...
Cross site scripting
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...
SAP NetWeaver J2EE Engine 7.40 SQL Injection
!/usr/bin/env python coding=utf-8 """ Author: Vahagn Vardanyan https://twitter.com/vah13 Bugs: CVE-2016-2386 SQL injection CVE-2016-2388 Information disclosure CVE-2016-1910 Crypto issue Follow HTTP request is a simple PoC for anon time-based SQL injection CVE-2016-2386 vulnerability in SAP...
SAP NetWeaver J2EE Engine 7.40 - SQL Injection Exploit
Exploit for multiple platform in category web applications !/usr/bin/env python coding=utf-8 """ Author: Vahagn Vardanyan https://twitter.com/vah13 Bugs: CVE-2016-2386 SQL injection CVE-2016-2388 Information disclosure CVE-2016-1910 Crypto issue Follow HTTP request is a simple PoC for anon...
