CVE-2023-0021

CVE-2023-0021 affects SAP NetWeaver versions 700–750. It stems from insufficient encoding of user input, allowing an unauthenticated attacker to inject code that can expose sensitive data (e.g., user IDs and passwords) and may lead to reflected Cross-Site Scripting. Endpoints are network-exposed,...

CVE-2023-0021 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver

Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...

PT-2023-20654 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver version 7.50 Description: The issue allows an authenticated attacker with sufficient privileges to access the XML parser, enabling them to submit a crafted XML file. When parsed, this file allows the attacker to access, but not...

SAP NetWeaver AS 代码问题漏洞

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. SAP NetWeaver AS suffers from an input validation error vulnerability, which stems from faulty input control and can be exploited by an attack...

SAP NetWeaver AS 路径遍历漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. SAP NetWeaver AS suffers from a path traversal vulnerability that arises when a network system or product fails to properly filter special elements i...

PT-2023-21403 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform versions 420, 430 Description: The issue allows an attacker to control a malicious BOE server, forcing the application server to connect to its own CMS, which can lead to a high impact on...

PT-2023-20196 · Sap · Sap Aba

Name of the Vulnerable Software and Affected Versions: SAP ABAP versions 751, 753, 754, 756, 757, 791 Description: The issue is caused by insufficient input sanitization, allowing an authenticated high privileged user to alter the current session of the user by injecting malicious database querie...

PT-2023-21047 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791 Description: The issue allows an attacker, authenticated as a non-administrative user, to craft a...

SAP Content Server 跨站脚本漏洞

SAP Content Server is a standalone component that can store any format and content. A cross-site scripting vulnerability exists in SAP Content Server version 7.53, which can be exploited by attackers to inject malicious JavaScript scripts...

SAP Solution Manager 代码注入漏洞

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

SAP NetWeaver 代码问题漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform primarily provides a development and runtime environment for SAP applications. A code issue vulnerability exists in SAP NetWeaver version 7.50 that originates from allowing an...

PT-2023-21402 · Sap · Sap Authenticator For Android

Name of the Vulnerable Software and Affected Versions: SAP Authenticator for Android version 1.3.0 Description: The issue allows an authorized attacker to capture the screen if a malicious app is installed on the mobile device. This could lead to the extraction of the currently viewed OTP and the...

SAP NetWeaver Application Server Java 访问控制错误漏洞

SAP NetWeaver AS Java is a German SAP SAP company provides a Java runtime environment for the application server. The product is mainly used to develop and run Java EE applications. An access control error vulnerability exists in SAP NetWeaver AS Java version 7.50, which stems from the fact that ...

PT-2023-20197 · Sap · Sap Netweaver Application Server For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791 Description: The issue concerns an unused class for error handling in SAP NetWeaver Application Server...

PT-2023-21401 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Web Services versions 420, 430 Description: The issue allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not...

SAP Authenticator 安全漏洞

SAP Authenticator is a mobile application from SAP that generates passwords for systems that require one-time password authentication. A security vulnerability exists in SAP Authenticator version 1.3.0, which originated from allowing an authorized attacker to install a malicious application on a...

SAP BusinessObjects Business Intelligence Platform 代码问题漏洞

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A code issue vulnerability exists in SAP BusinessObjects Business...

PT-2023-15953 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver versions 700 through 750 Description: The issue is caused by insufficient encoding of user input, allowing an unauthenticated attacker to inject code. This can expose sensitive data, such as user id and password, and may lead to...

PT-2023-21048 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Web Services versions 420, 430 Description: The issue allows an attacker to control a malicious BOE server, forcing the application server to connect to its own admintools. This results in a...

SAP NetWeaver Application Server 访问控制错误漏洞

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. An access control error vulnerability exists in SAP NetWeaver AS version 7.50, which stems from the fact that no authentication checks are...