CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

CVE-2020-6293

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access...

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver ABAP Server and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure...

Unrestricted file upload

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access...

Authentication flaw

SAP NetWeaver AS JAVA, versions - ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11, does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service...

Information disclosure

SAP NetWeaver ABAP Server and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value help, leading to Information Disclosure...

Cross site scripting

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

CVE-2020-6309

SAP NetWeaver AS JAVA, versions - ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11, does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service...

Code injection

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

Improper access control

Improper access control in SOA Configuration Trace component in SAP NetWeaver ABAP Server and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure...

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver ABAP Server and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure...

CVE-2020-6309

SAP NetWeaver AS JAVA, versions - ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11, does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service...

CVE-2020-6296

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2020-6296

SAP NetWeaver ABAP Server/ABAP Platform (versions 700–755 listed) is affected by CVE-2020-6296, enabling code injection via a vulnerability in the application that could let an attacker control behavior. Connected sources confirm the root cause is code injection in these components. Exploitation ...

CVE-2020-6293

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access...

CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

PT-2020-5170 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755 Description: The issue allows a business user to access the list of users in the given system using value help, leading to Information Disclosure. It is...

PT-2020-5977 · Sap · Sap Netweaver +2

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Server and ABAP Platform, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755 Description: The issue allows an attacker to inject code that can be executed by the application, leading to code injection. This...

SAP NetWeaver Remote Code Execution (CVE-2020-6287)

A remote code execution vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

SAP NetWeaver Directory Traversal (CVE-2020-6286; CVE-2020-6287)

A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could lead to disclosure of file contents accessible by the prime user...