SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection Vulnerability

Exploit for windows platform in category remote exploits Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTCREFRESHEXPORTTABCOMP 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the...

SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection

Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTCREFRESHCHECKENV 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system. Risk Level: Critical 2. Advisory Information...

SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection

Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTCREFRESHEXPORTTABCOMP 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system. Risk Level: Critical 2. Advisory Information...

PT-2016-23

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the /com.sapportals.navigation.testComponent.NavigationRequestSniffer component of the SAP NetWeaver platform, which is vulnerable due to the lack of protection...

PT-2016-15

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the /com.sap.portal.design.datamigration.LogPortalComponent component of the SAP NetWeaver platform, which is vulnerable due to insufficient protection of the we...

PT-2016-16

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue arises from insufficient cleaning of user-input data when it is displayed on the log view page, specifically affecting the UpdateThemeVersionPortalComponent. This could allow ...

PT-2016-25

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to a component that checks hidden content in the SAP NetWeaver platform, which has an incorrect restriction on XML links to external objects. This can be exploited ...

PT-2016-22

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the incorrect restriction of XML links to external objects in a component of the SAP NetWeaver platform. This could allow a remote attacker to gain access to...

PT-2016-18

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue exists due to incorrect restriction of the directory path name with limited access in the Log Viewer component of the SAP NetWeaver platform. This allows an attacker to bypass...

PT-2016-17

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the /com.sap.portal.themes.styleservice.LockingTestPortalComponent component of the SAP NetWeaver platform, which is vulnerable due to insufficient protection of...

PT-2016-26

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the YWorksLayouter component of the SAP NetWeaver platform, which has a problem with improper restriction of XML external entity references. This could allow a...

PT-2016-20

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the FloorPlanApp component of the SAP NetWeaver platform, which has a problem with improper restriction of XML external entity references. This could allow a...

PT-2016-21

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue exists due to insufficient protection of the web page structure, allowing for reflected cross-site scripting. This could enable a remote attacker to inject arbitrary HTML tags...

PT-2016-27

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue exists due to insufficient data sanitization when copying data from requests to responses in the DownloadServlet component of the SAP NetWeaver integration platform. This coul...

PT-2016-19

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to insufficient data protection in the MembersApp component of the SAP NetWeaver platform. It allows a remote attacker to disclose user information, such as listing...

PT-2016-24

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to the TranslationSupport component of the SAP NetWeaver integration platform, which is affected by incorrect restriction of XML links to external objects. This can...

SAP NetWeaver - buffer overflow vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.0-7.5 Vendor URL: SAP Bugs: buffer overflow Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 12.07.2016 Reference: SAP Security Note 2295238 Author: Dmitry Yudin ERPScan VULNERABILITY INFORMATION Class: Denial ...

SAP NetWeaver AS JAVA - XXE vulnerability in BC-BMT-BPM-DSK component (CVE-2016-9563)

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.5 Vendor URL: SAP Bugs: XXE Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2296909 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XXE...

SAP NetWeaver AS JAVA Denial of Service Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications.SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language. A denial of service vulnerability...

SAP NetWeaver AS Java Information Disclosure Vulnerability (2255990) - Active Check

SAP NetWeaver Application Server AS Java is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...