PT-2017-12616

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java version 7.5 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. dot dot in the query string. This issue has been exploited in the wild...

CVE-2017-12637: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657...

VulnCheck KEV: CVE-2017-12637

SAP NetWeaver Application Server AS Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. dot dot in the query string...

SAP NetWeaver AS JAVA XML External Entity Injection Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide the development and operation environment for SAP applications. SAP NetWeaver AS Application Server Java is a run in NetWeaver and based on the Java programming language...

SAP Netweaver Application Server Java Remote Authorization Bypass Vulnerability

SAP NetWeaver is SAP's integrated service-oriented application platform that provides a development and runtime environment for SAP applications. SAP NetWeaver Application Server AS Java is an application server that runs on NetWeaver and is based on the Java programming language. SAP NetWeaver...

SAP NetWeaver Application Server Java Denial of Service Vulnerability

SAP NetWeaver Application Server AS Java is an application server that runs in NetWeaver and is based on the Java programming language. A denial of service vulnerability exists in SAP NetWeaver Application Server Java. An attacker could exploit the vulnerability to cause a denial of service...

SAP NetWeaver Application Server Invoker Servlet Arbitrary Code Execution Vulnerability

SAP NetWeaver is SAP's integrated service-oriented application platform that provides a development and runtime environment for SAP applications. SAP NetWeaver Application Server AS Java is an application server that runs on NetWeaver and is based on the Java programming language. SAP NetWeaver...

CVE-2010-5326: Missing Authentication for Critical Function

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack...

PT-2016-3365

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions prior to 7.3 Description The issue is related to the Invoker Servlet component of the SAP NetWeaver Java Application Server, which has weaknesses in its authentication procedure. This can be...

PT-2015-5693

Name of the Vulnerable Software and Affected Versions SAP MaxDB versions 7.5 through 7.6 Netweaver Application Server ABAP affected versions not specified Netweaver Application Server Java affected versions not specified Netweaver RFC SDK affected versions not specified GUI affected versions not...

CVE-2015-2282: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the LZC decompression implementation CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows...

CVE-2015-2278: Improper Restriction of Operations within the Bounds of a Memory Buffer

The LZH decompression implementation CsObjectInt::BuildHufTree function in vpa108csulzh.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers t...

PT-2015-5695

Name of the Vulnerable Software and Affected Versions SAP MaxDB versions 7.5 through 7.6 Netweaver Application Server ABAP affected versions not specified Netweaver Application Server Java affected versions not specified Netweaver RFC SDK affected versions not specified GUI affected versions not...

CVE-2014-8590

XML external entity XXE vulnerability in the Web Service Navigator in SAP NetWeaver Application Server AS Java allows remote attackers to access arbitrary files via a crafted request...

Zend Server Java Bridge Remote Code Execution

Added: 04/08/2011 BID: 47060 OSVDB: 71420 Background Zend Server is an enterprise web application server for hosting PHP applications. Problem The Zend Server Java Bridge allows PHP applications to execute methods in Java classes. The Java Bridge does not validate that requests to execute Java co...

Zend Server Java Bridge Arbitrary Java Code Execution

$Id: zendjavabridge.rb 12242 2011-04-05 01:08:07Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CVE-2009-2932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server Java 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field...