SAP NetWeaver Cross Site Scripting

http://www.dsecrg.com/pages/vul/show.php?id=133 Digital Security Research Group DSecRG Advisory DSECRG-09-033 Application: SAP NetWeaver Application Server Java Versions Affected: Version 7.0 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date ...

[DSECRG-09-033] SAP Netweaver UDDI - XSS Security Vulnerability

http://www.dsecrg.com/pages/vul/show.php?id=133 Digital Security Research Group DSecRG Advisory DSECRG-09-033 Application: SAP NetWeaver Application Server Java Versions Affected: Version 7.0 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date ...

SAP Netweaver SQL Monitors — Multiple XSS

Application: SAP Netweaver Administrator panel Versions Affected: SAP Netweaver Administrator panel from ECC 6.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 07.09.2009 Vendor response: 08.09.2009 Date of Public Advisory: 09.11.2010 Author: Alexandr Polyakov and Alexey Troshichev Description Ope...

SAP Netweaver wsnavigator — XSS Security Vulnerability

Application: SAP Netweaver Versions Affected: Version 6.4-7.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 26.05.2009 Vendor response: 27.05.2009 Date of Public Advisory: 13.07.2010 Author: Alexander Polyakov Description SAP Netweaver system has linked XSS security vulnerability in wsnavigator...

SAP Cfolders Multiple Linked XSS Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-021 Original advisory: http://dsecrg.com/pages/vul/show.php?id=121 Application: SAP Cfolders SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms collaboration rooms Vendor URL: http://SAP.com Bugs: Multiple Liked XSS Risk:...

SAP Cfolders Multiple Stored XSS Vulnerabilies

Digital Security Research Group DSecRG Advisory DSECRG-09-014 Original advisory: http://dsecrg.com/pages/vul/show.php?id=114 Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: http://SAP.com Bugs: Multiple Stored XSS Risk: Hight...

SAP Cfolders Stored Cross Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-09-014 Original advisory: http://dsecrg.com/pages/vul/show.php?id=114 Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: http://SAP.com Bugs: Multiple Stored XSS Risk: Hight...

SAP NetWeaver Application Server (UDDI client) XSS Vulnerability

Application: SAP NetWeaver Application Server Java Versions Affected: Version 7.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date of Public Advisory: 11.08.2009 Reference: SAP Security Note 1322098 Author: Alexandr Polyakov Description SAP NetWeaver...

SAP NetWeaver和Web Dynpro Portal跨站脚本执行漏洞

BUGTRAQ ID: 33465 SAP NetWeaver是一种企业IT系统整合管理系统。 SAP NetWeaver的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞控制应用系统。 SAP NetWeaver没有对用户提交的数据做充分的检查过滤，远程攻击者可能在输入中插入来意脚本代码，使用此应用的其他用户客户端浏览器可能会执行攻击者提交脚本代码，构成跨站脚本执行攻击。Web Dynpro Portal应用也存在类似的问题。 SAP NetWeaver 4.x 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-3358

Cross-site scripting XSS vulnerability in Web Dynpro WD in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document...

Cross site scripting

Cross-site scripting XSS vulnerability in Web Dynpro WD in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain document...

CVE-2008-3358

CVE-2008-3358 is an XSS vulnerability in SAP NetWeaver Portal’s Web DynPro component. A crafted URI can reflect arbitrary script/HTML in a text/plain response when using Internet Explorer 7.0.5730, enabling remote attackers to execute client-side code in the victim’s browser. Root cause is unenco...

Errata: [TZO-2009-1] Avira Antivir - RAR - Division by Zero & Null Pointer Dereference

Errata : Products listed but not affected : AVIRA WebProtector for KEN! - Reason: Does not use the Scan Engine Avira AntiVir Mobile - Reason: Does not use the same AV Engine Avira requested the following products to be removed from the list, for the reason that they are license models and not...

Cross site scripting

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" aka Editor Security or Secure Editing parameter, which allows remote attackers to conduct cross-site scripting XSS attacks by entering feedback for a file...

CVE-2008-1846

The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" aka Editor Security or Secure Editing parameter, which allows remote attackers to conduct cross-site scripting XSS attacks by entering feedback for a file...

SAP Cfolders Multiple Stored XSS Vulnerabilies

Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: Bugs: Multiple Stored XSS Risk: High Exploits: YES Reported: 04.12.2008 Vendor response: 05.12.2008 Vulnerability patched: 15.12.2008 Date of Public Advisory: 21.04.2009 Referenc...

SAP Netweaver 6.40-7.0 Cross-Site-Scripting

Title: SAP Netweaver 6.40-7.0 Persistent Cross-Site-Scripting Author: Jaime Blasco at aitsec.com http://www.aitsec.com Description: SAP Netweaver have a web interface for accesing filesystem of the portal, users can make "feedbacks" of files, input passed to the content of these feedbacks is not...

CVE-2007-3615

Internet Communication Manager aka ICMAN.exe or ICM in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service process crash via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web...

Design/Logic Flaw

Internet Communication Manager aka ICMAN.exe or ICM in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service process crash via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web...

CVE-2007-3496

Cross-site scripting XSS vulnerability in SAP Web Dynpro Java BC-WD-JAV in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to inject arbitrary web...