SAP NetWeaver Dispatcher Multiple Vulnerabilities - RCE, DoS

Application: SAP NetWeaver Dispatcher Versions Affected: SAP KERNEL 7.00 32BIT, disp+work.exe 7000.52.12.34966 Vendor URL: http://www.sap.com Bugs: Buffer overflow CWE-119, Integer overflow CWE-190, Improper Input Validation CWE-20 CVSS: AV:N/AC:H/Au:S/C:C/I:C/A:C 7.1 Exploits: PoC Reported:...

CVE-2014-3787

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...

Code injection

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...

CVE-2014-3787

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...

SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS

Application: SAP NetWeaver Dispatcher Versions Affected: SAP KERNEL 7.00 32BIT, disp+work.exe 7000.52.12.34966 SAP KERNEL 7.20 64BIT, disp+work.exe 7200.117.19.50294 Vendor URL: Bugs: Buffer overflow CWE-119 CVSS according to ERPScan: AV:N/AC:H/Au:S/C:C/I:C/A:C 7.1 CVSS according to SAP:...

CVE-2014-3130

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2014-3133

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

CVE-2014-3129

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

Design/Logic Flaw

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

Design/Logic Flaw

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2014-3133

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

CVE-2014-3130

Technical details (affected product/version, root cause, exploit information) are not provided in the supplied documents for CVE-2014-3130; monitor for updates.

CVE-2014-3130

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

PT-2014-09: Sensitive Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in SAP NetWeaver. An attacker can read any tables from SAP Central User Administration SAP CUA via accessing the system affiliated with SAP CUA. How to fix Update your software up to the...

CVE-2014-1964

Cross-site scripting XSS vulnerability in the Integration Repository in the SAP Exchange Infrastructure BC-XI component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error...

CVE-2014-1961

Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors...

CVE-2014-1963

Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors...

CVE-2014-1965

Cross-site scripting XSS vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure BC-XI component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP...