CVE-2023-33989 Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)

An attacker with non-administrative authorizations in SAP NetWeaver BI CONT ADD ON - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system...

CVE-2023-33989

CVE-2023-33989 concerns SAP NetWeaver BI CONT ADD ON (versions 707, 737, 747, 757) with a directory traversal flaw that can overwrite system files. The root cause is improper path filtering, allowing an attacker with non-administrative authorizations (network access) to target OS files and potent...

CVE-2023-33988 Cross-Site Scripting vulnerability in SAP Enable Now

In SAP Enable Now - versions WPBMANAGER 1.0, WPBMANAGERCE 10, WPBMANAGERHANA 10, ENABLENOWCONSUMPDEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in...

CVE-2023-33988

CVE-2023-33988 affects SAP Enable Now components: WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704. The vulnerability stems from the absence of implemented Content-Security-Policy and X-XSS-Protection headers, enabling an unauthenticated attacker to attempt ref...

CVE-2023-33988 Cross-Site Scripting vulnerability in SAP Enable Now

In SAP Enable Now - versions WPBMANAGER 1.0, WPBMANAGERCE 10, WPBMANAGERHANA 10, ENABLENOWCONSUMPDEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected cross-site scripting, which could result in...

CVE-2023-33987

The CVE-2023-33987 issue affects SAP Web Dispatcher and related components (WEBDISP, KERNEL, KRNL64NUC/UC, HDB, XS_ADVANCED_RUNTIME, SAP_EXTENDED_APP_SERVICES) where an unauthenticated, network-proximate attacker can submit crafted requests to a front-end server. Over multiple attempts, this can ...

CVE-2023-33987 Request smuggling and request concatenation in SAP Web Dispatcher

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL...

CVE-2023-33987 Request smuggling and request concatenation in SAP Web Dispatcher

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL...

CVE-2023-31405

SAP NetWeaver AS for Java (ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50) is affected by a log-injection vulnerability via unauthenticated network requests that can modify system logs without user interaction. The root cause is log injection from network input; there is no information disclosur...

CVE-2023-31405 Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any...

CVE-2023-31405 Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any...

SAP Enable Now 安全漏洞

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for online learning and training in SAP and non-SAP systems, among other things. A security vulnerability exists in SAP Enable Now that stems from an unimplemented...

PT-2023-4071 · Sap · Sap Netweaver Process Integration

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Process Integration version SAP XIAF 7.50 Description: The issue is related to the Message Display Tool MDT component of SAP NetWeaver Process Integration, which lacks proper authentication checks for certain functionalities. Th...

PT-2023-4096 · Sap · Sap Enable Now

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704 Description: The issue is related to the absence of the X-Content-Type-Options response header, which allows an unauthenticated...

PT-2023-4048 · Sap · Sap Extended App Services +5

Name of the Vulnerable Software and Affected Versions: SAP Web Dispatcher versions WEBDISP 7.53 through WEBDISP 7.93 KERNEL versions 7.53 through 7.93 KRNL64UC version 7.53 HDB version 2.00 XS ADVANCED RUNTIME version 1.00 SAP EXTENDED APP SERVICES version 1 Description: The vulnerability is...

SAP Web Dispatcher 缓冲区错误漏洞

SAP Web Dispatcher is the core component of Load Balancing from SAP, which supports load balancing and provides reverse proxy functionality so that external users can access internal applications. A buffer overflow vulnerability exists in SAP Web Dispatcher, which is caused by a logical error in...

PT-2023-4046 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA versions S4CORE 104 through 107 Description: The issue is related to insufficient access control in the Manage Journal Entry Template component of SAP S/4HANA. This can allow a remote attacker to read, modify, or delete files. Whe...

SAP Enable Now 跨站脚本漏洞

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning, training, etc. in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now, which stems from an unimplemented...

PT-2023-4098 · Sap · Sap Enable Now

Name of the Vulnerable Software and Affected Versions: SAP Enable Now versions WPB MANAGER 1.0, WPB MANAGER CE 10, WPB MANAGER HANA 10, ENABLE NOW CONSUMP DEL 1704 Description: The issue is related to the lack of implementation of the Referrer-Policy response header in SAP Enable Now, allowing an...

SAP NetWeaver ABAP Server 操作系统命令注入漏洞

SAP NetWeaver ABAP Server is a German SAP SAP company used as a Web application server for SAP products. SAP NetWeaver ABAP Server suffers from an operating system command injection vulnerability that arises from the application failing to properly filter constructor command special characters,...