CVE-2012-2513

CVE-2012-2513 affects SAP NetWeaver Dispatcher (disp+work.exe) in SAP NetWeaver 7.0 EHP1/EHP2. The vulnerability is triggered in the vulnerable dispatcher by sending specially crafted SAP Diag packets, targeting the Diaginput function, potentially causing a remote denial of service (daemon crash)...

SAP NetWeaver multiple security vulnerabilities

Multiple vulnerabilities in Dispatcher service...

SAP Netweaver Dispatcher Multiple Vulnerabilities

Exploit for windows platform in category dos / poc SAP Netweaver Dispatcher Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL:...

SAP NetWeaver Dispatcher - Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Netweaver Dispatcher Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL:...

SAP NetWeaver Dispatcher - Multiple Vulnerabilities

SAP NetWeaver Dispatcher - Multiple Vulnerabilities Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Netweaver Dispatcher Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL:...

SAP Netweaver 7.0 EHP1/EHP2 Buffer Overflows

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ SAP Netweaver Dispatcher Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL:...

CVE-2012-1289

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to 1 b2b/admin/log.jsp or 2 b2b/admin/logview.jsp in the Internet Sales crm.b2b component, or 3 ipc/admin/log.jsp or 4...

CVE-2012-1292

Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors...

Design/Logic Flaw

Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors...

Code injection

Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servletjsp service...

Directory traversal

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to 1 b2b/admin/log.jsp or 2 b2b/admin/logview.jsp in the Internet Sales crm.b2b component, or 3 ipc/admin/log.jsp or 4...

CVE-2012-1289

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the logfilename parameter to 1 b2b/admin/log.jsp or 2 b2b/admin/logview.jsp in the Internet Sales crm.b2b component, or 3 ipc/admin/log.jsp or 4...

CVE-2012-1292

Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors...

CVE-2012-1290

The CVE-2012-1290 entry describes a Cross-site scripting (XSS) vulnerability in SAP NetWeaver 7.0, specifically in the Internet Sales (crm.b2b) module and the b2b/auction/container.jsp page. The issue is exploitable via the _loadPage parameter, allowing an attacker to inject arbitrary web script ...

CVE-2011-4707

Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the 1 instname parameter to the VsiTestScan servlet and 2 name parameter to the VsiTestServlet servlet...

SAP NetWeaver SOAP RFC - CSRF

Application: SAP BASIS Vendor URL: http://www.sap.com Bugs: CSRF Exploits: YES Reported: 12.03.2011 Vendor response:13.03.2011 Date of SAP Security Note published: 14.08.2012 Date of Public Advisory:13.11.2012 Reference: SAP Security Note 1728500 Author: Alexey Tyurin ERPScan Description It is...

SAP NetWeaver multiple security vulnerabilities

Authentication bypass, crosste scripting, code injection, information leakage...

[DSECRG-11-037] SAP BW Doc - Multiple XSS

DSECRG-11-037 SAP BW Doc - Multiple XSS BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 14.03.2011 Vendor response: 16.03.2011 Date of Public Advisory: 11.11.20...

[DSECRG-11-041] SAP NetWeaver - Authentication bypass (Verb Tampering)

DSECRG-11-041 SAP NetWeaver - Authentication bypass Verb Tampering Authentication bypass vulnerability in SAP NetWeaver CTC service can be exploited for unauthorized user management and OS command execution. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.co...