PT-2019-4567 · Sap · Sap Netweaver As For Abap/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP Platform versions prior to 7.02 SAP NetWeaver AS ABAP Platform versions prior to 7.11 SAP NetWeaver AS ABAP Platform versions 7.30 SAP NetWeaver AS ABAP Platform versions 7.31 SAP NetWeaver AS ABAP Platform versions 7.40...

The vulnerability of the userprefs component in the software platform for collaborative development of SAP NetWeaver Development Infrastructure Cockpit allows a attacker to execute arbitrary code.

The vulnerability of the userprefs component /nwdicockpit/srv/data/ of the software development platform for SAP NetWeaver Development Infrastructure Cockpit is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute...

SAP NetWeaver AS Java Information Disclosure Vulnerability

SAP NetWeaver is a service-oriented integrated application platform from SAP, which provides a development and runtime environment for SAP applications. SAP NetWeaver AS Application Server Java is an application server that runs on NetWeaver and is based on the Java programming language. keystore...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2492

SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50...

Cross site scripting

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2503

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

SAP NetWeaver Knowledge Management (XMLForms) XML External Entity Injection Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications. An XML external entity injection vulnerability exists in Knowledge Management XMLForms in SAP NetWeaver, which can be exploited by an attacker to gain...

CVE-2018-2476

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

CVE-2018-2477

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

Design/Logic Flaw

Knowledge Management XMLForms in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source...

Design/Logic Flaw

Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site...

http-sap-netweaver-leak NSE Script

Detects SAP Netweaver Portal instances that allow anonymous access to the KM unit navigation page. This page leaks file names, ldap users, etc. SAP Netweaver Portal with the Knowledge Management Unit enable allows unauthenticated users to list file system directories through the URL...

CVE-2018-2470

In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

SAP NetWeaver AS Java Detection (HTTP)

HTTP based detection of SAP NetWeaver Application Server AS Java. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

SAP NetWeaver AS JAVA Cross-Site Scripting Vulnerability (CNVD-2019-09631)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide the development and operation environment for SAP applications. SAP NetWeaver AS Application Server Java is a run in NetWeaver and based on the Java programming language...

CVE-2018-2452

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...

Cross site scripting

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting XSS vulnerability...