SAP NetWeaver Portal ConfigServlet Remote Command Execution

A remote command execution vulnerability has been reported in SAP NetWeaver. The vulnerability is due to insufficient validation in SAP ConfigServlet handling of incoming GET requests. By sending a specially-crafted GET request, an attacker could exploit this vulnerability to inject and execute...

SAP NetWeaver AS Java XML External Entity Vulnerability

SAP NetWeaver is SAP's software base platform, divided into SAP Netweaver JAVA and Netweaver ABAP. Its predecessor is SAP BASIS components. Because of the development of the Internet and JAVA, SAP adjusted the architecture of the basic platform, adding support for JAVA, but also to enhance the...

Xxe

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2015-4091

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2015-4091

CVE-2015-4091 describes an XML External Entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4. The issue arises when the SAP XML parser at /sap.com/tc~sld~wd~main/Main processes incoming XML requests with a user-specified DTD (CIM UPLOAD), potentially allowing remote attackers to send TCP reque...

Stack Buffer Overflow Vulnerability in Multiple SAP Products

SAP NetWeaver is an integrated service-oriented application platform that provides a development and runtime environment for SAP applications; ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language; and SAP .NET Connector is a connector betwe...

Denial of Service Vulnerability in Multiple SAP Products

SAP NetWeaver is an integrated service-oriented application platform that provides a development and runtime environment for SAP applications; ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language; and SAP .NET Connector is a connector produ...

SAP NetWeaver RFC SDK Information Disclosure Vulnerability

SAP NetWeaver is a business suite of solutions that provides a development and runtime environment for SAP applications. the RFC SDK is one of the software development kits used to build C++ function-controlled RFC communications on an external client. An information disclosure vulnerability exis...

CVE-2015-3981

SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037...

CVE-2015-3981

SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037...

SAP NetWeaver - internal special account password leak

Application: SAP Netweaver Versions Affected: SAP Netweaver 7.4 Vendor URL: SAP Bugs: Coding error, Reading sensitive user data Send: 05.09.2015 Reported: 05.09.2015 Vendor response: 06.09.2015 Date of Public Advisory: 08.12.2015 Reference: SAP Security Note 2240946 Author: Dmitry Chastuhin,...

SAP xMII - Reflected XSS vulnerability

Application: SAP NetWeaver AS JAV Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: SAP Bugs: XSS Reported: 05.05.2015 Vendor response: 06.05.2015 Date of Public Advisory: 12.04.2016 Reference: SAP Security Note 2201295 Author: Nursultan Abubakirov , Vahagn Vardanyan ERPScan VULNERABILITY...

SAP NetWeaver 7.4 - XXE

Application: SAP NetWeaver Portal 7.4 Vendor URL: http://www.sap.com Bugs: XML eXternal Entity Reported: 16.04.2015 Vendor response: 17.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Authors: Roman Bezhan ERPScan VULNERABILITY INFORMATION Class: XML External Enti...

SAP NetWeaver directory creation outside of the JVM

Application: SAP NetWeaver Versions Affected: SAP NetWeaver AS JAVA UMEADMIN component Vendor URL: SAP Bugs: Directory traversal Reported: 04.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 13.12.2016 Reference: SAP Security Note 2310790 Author: Mathieu Geli ERPScan VULNERABILITY...

SAP NetWeaver AS Java 7.4 DataArchivingService servlet XSS

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: SAP Bugs: XXS Reported: 04.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 11.04.2017 Reference: SAP Security Note 2308535 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS...

SAP JAVA AS jstart - DoS vulnerability

Application: SAP JAVA AS Versions Affected: SAP JAVA AS 7.2 – 7.4 Vendor URL: SAP Bugs: Denial of Service Reported: 04.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 14.03.2016 Reference: SAP Security Note 2259547 Author: Dmitry Yudin ERPScan @ret5et Vulnerability Information Class:...

SAP JAVA AS icman - DoS vulnerability

Application: SAP JAVA AS Versions Affected: SAP JAVA AS 7.2 – 7.4 Vendor URL: SAP Bugs: Denial of Service Reported: 04.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 14.03.2016 Reference: SAP Security Note 2256185 Author: Dmitry Yudin ERPScan @ret5et Vulnerability Information Class:...

SAP NetWeaver Java AS WD_CHAT - Information disclosure vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.1 – 7.5 Vendor URL: SAP Bugs: Information disclosure Reported: 04.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 08.03.2016 Reference: SAP Security Note 2255990 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION...

SAP NetWeaver Portal XMLValidationComponent XXE Information Disclosure Vulnerability

SAP NetWeaver is the technology foundation for SAP Business Suite solutions, SAP xApps portfolio applications, partner solutions, and customized applications. An XXE external entity reference vulnerability exists in SAP NetWeaver Portal XMLValidationComponent, which allows remote attackers to...

SAP NetWeaver Portal XXE Information Disclosure Vulnerability

SAP NetWeaver is the technology foundation for SAP Business Suite solutions, SAP xApps portfolio applications, partner solutions, and customized applications. An XL External Entity Reference vulnerability exists in SAP NetWeaver Portal ReportXmlViewer, which allows remote attackers to submit...