PT-2013-5979

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.31 and earlier Description The issue allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an...

CVE-2013-6244: Undefined Security Weakness

The Live Update webdynpro application webdynpro/dispatcher/sap.com/tcslmuilup/LUP in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an...

CVE-2013-5751

Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2013-5751

Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2013-5751

The CVE-2013-5751 entry describes a directory traversal vulnerability in SAP NetWeaver 7.x that could allow remote attackers to read arbitrary files via unspecified vectors. Connected sources confirm the affected product (SAP NetWeaver 7.x) and the vulnerability class (directory traversal), but d...

PT-2013-5766

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.x Description A directory traversal issue allows remote attackers to read arbitrary files. Recommendations For SAP NetWeaver version 7.x, update to a version that includes a fix for this issue...

CVE-2013-5751: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2013-5723

SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0DELETEDERIVATIONTABLE."...

Sql injection

SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0DELETEDERIVATIONTABLE."...

CVE-2013-5723

SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0DELETEDERIVATIONTABLE."...

CVE-2013-5723: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0DELETEDERIVATIONTABLE."...

PT-2013-5755

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.30 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0 DELETE DERIVATION TABLE." Recommendations For SAP NetWeaver version 7.30, apply t...

SAP NetWeaver ECATT_DISPLAY_XMLSTRING_REMOTE - XXE

Application: SAP NetWeaver AS ABAP Versions Affected: SAP NetWeaver AS ABAP 7.31, probably others Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 09.07.2013 Vendor response: 10.07.2013 Date of Public Advisory: 20.01.2015 Reference: SAP Security Note 2016638 Authors: Nikolay...

SAP NetWeaver SOAP Request SXPG_CALL_SYSTEM Command Execution

A remote command execution vulnerability has been reported in SAP NetWeaver's SOAP interface...

CVE-2013-3319

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128...

CVE-2013-3319

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128...

CVE-2013-3319

CVE-2013-3319 affects SAP NetWeaver 7.03 via the HostControl service GetComputerSystem method, enabling remote disclosure of sensitive information through a crafted SOAP request to port 1128. Public references in Nessus note and vendor advisories (SAP Note 1816536) detail sensitive data exposure ...

CVE-2013-3319: Exposure of Sensitive Information to an Unauthorized Actor

The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128...

PT-2013-4286

Name of the Vulnerable Software and Affected Versions SAP Netweaver version 7.03 Description The issue allows remote attackers to obtain sensitive information via a crafted SOAP request to the "TCP port 1128" endpoint, specifically targeting the GetComputerSystem method in the HostControl service...