Design/Logic Flaw

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

Design/Logic Flaw

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2014-3133

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

CVE-2014-3130

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2014-3130

Technical details (affected product/version, root cause, exploit information) are not provided in the supplied documents for CVE-2014-3130; monitor for updates.

PT-2014-5108

Name of the Vulnerable Software and Affected Versions SAP Netweaver Java Application Server affected versions not specified Description The issue is related to improper access restriction in the SAP Netweaver Java Application Server, allowing remote attackers to obtain the list of SAP systems...

PT-2014-5104

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified SAP Solution Manager version 7.1 Description The issue allows remote attackers to obtain sensitive information via a crafted request to the Java Server Pages in the Software Lifecycle Manager SLM i...

CVE-2014-3130: Undefined Security Weakness

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

PT-2014-5105

Name of the Vulnerable Software and Affected Versions SAP Netweaver ABAP Application Server affected versions not specified Description The issue concerns the ABAP Help documentation and translation tools BC-DOC-HLP in SAP Netweaver ABAP Application Server, where access is not properly restricted...

CVE-2014-3133: Undefined Security Weakness

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

CVE-2014-3129: Exposure of Sensitive Information to an Unauthorized Actor

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

CVE-2013-7364: Undefined Security Weakness

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

PT-2014-3395

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified Description The issue is related to an unspecified J2EE core service in the J2EE Engine, which does not properly restrict access. This allows remote attackers to read and write to arbitrary files v...

PT-2014-09: Sensitive Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in SAP NetWeaver. An attacker can read any tables from SAP Central User Administration SAP CUA via accessing the system affiliated with SAP CUA. How to fix Update your software up to the...

PT-2014-1224

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.20 and earlier Description The issue allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables. This can be exploited by attackers to gain unauthorized access to sensitive data in the...

CVE-2014-1961

Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors...

CVE-2014-1963

Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors...

CVE-2014-1964

Cross-site scripting XSS vulnerability in the Integration Repository in the SAP Exchange Infrastructure BC-XI component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error...