CVE-2022-22536

CVE-2022-22536 affects SAP NetWeaver components (ABAP/Java stacks), ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher. The issue is HTTP request smuggling/concatenation caused by how the SAP ICM front end parses requests, enabling an unauthenticated attacker to prepend arbitrary data...

CVE-2022-22540

SAP NetWeaver AS ABAP Workplace Server - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database. Successful attacks could result in disclosure of a table of contents from the system,...

CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the...

CVE-2022-22538

SAP 3D Visual Enterprise Viewer 9.0 is affected by CVE-2022-22538 through AI file parsing. The vulnerability is an out-of-bounds/write condition in the AI parsing code that can allow remote code execution. Exploitation requires a user to open a malicious AI/.ai.x3d file (user interaction), potent...

CVE-2022-22538

When a user opens a manipulated Adobe Illustrator file format .ai, ai.x3d received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with...

CVE-2022-22537

When a user opens a manipulated Tagged Image File Format .tiff, 2d.x3d received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with the...

CVE-2022-22537

CVE-2022-22537 affects SAP 3D Visual Enterprise Viewer (v9.0) and is triggered by opening manipulated TIFF/2d.x3d files from untrusted sources, causing the application to crash and become temporarily unavailable until restart. Connected sources confirm the affected product/version and describe th...

CVE-2022-22535

SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause...

CVE-2022-22535

CVE-2022-22535 is described as a permissions issue in SAP ERP HCM Portugal (versions 600–608) where a payroll-report reads payroll data without proper authorization checks. The root cause is insufficient access checks for that report, enabling read-only exposure of payroll information in a specif...

CVE-2022-22534

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the...

CVE-2022-22534

CVE-2022-22534 affects SAP NetWeaver Application Server (NetWeaver ABAP/AS) through insufficient input encoding , enabling an unauthenticated attacker to inject code and potentially expose sensitive data such as user IDs and passwords . The endpoints are normally network-exposed, with a partial c...

CVE-2022-22533

Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could submit multiple HTTP server requests resulting in errors, such that it consumes the memory buffer. This...

CVE-2022-22533

SAP NetWeaver Application Server Java (KRNL64NUC 7.22/7.22EXT/7.49, KRNL64UC 7.22/7.22EXT/7.49/7.53, KERNEL 7.22/7.49/7.53) is affected by CVE-2022-22533. The issue arises from improper error handling that allows an attacker to submit multiple HTTP server requests, triggering errors and consuming...

CVE-2022-22532

Summary (CVE-2022-22532) : SAP NetWeaver Application Server Java is affected in multiple builds (KRNL64NUC 7.22/7.22EXT/7.49/7.53 and KERNEL 7.22/7.49/7.53). An unauthenticated attacker can send a crafted HTTP request that triggers improper shared memory buffer handling, enabling execution of a p...

CVE-2022-22528

CVE-2022-22528 affects SAP Adaptive Server Enterprise (ASE) version 16.0 on Windows, where the installer writes an entry to the system PATH. Under certain conditions this can allow a Standard User to execute malicious Windows binaries, enabling local privilege escalation. The issue is tied to the...

CVE-2022-22532

In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the...

CVE-2022-22528

SAP Adaptive Server Enterprise ASE - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certain conditions, allows a Standard User to execute malicious Windows binaries which may lead to privilege escalation on the local system. The...

PT-2022-15513 · Sap · Sap Web Dispatcher +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP Kernel and ABAP Platform Kernel versions 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 8.04 Description: The software does not sufficiently validate sap-passport information, which could le...

PT-2022-15515 · Sap · Sap Business Objects Web Intelligence

Name of the Vulnerable Software and Affected Versions: SAP Business Objects Web Intelligence BI Launchpad version 420 Description: The issue arises from improper HTML encoding in input control summary, allowing an authorized attacker to execute a cross-site scripting XSS attack. Recommendations:...

PT-2022-15514 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: A high privileged user who has access to transaction SM59 can read connection details stor...