CVE-2006-5784

CVE-2006-5784 affects SAP Web Application Server 6.40 (before patch 136) and 7.00 (before patch 66), specifically enserver.exe. The vulnerability allows remote attackers to read arbitrary files by sending crafted data to a TCP port in the 3200+SYSNR range, demonstrated via port 3201. Additionally...

CVE-2006-5785

SAP Web Application Server is affected by CVE-2006-5785. The issue allows remote denial of service (enserver.exe crash) on UDP port 64999 via a 0x72F2 sequence for SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66. The vulnerability is confirmed in the NVD entry for CVE-20...

CVE-2006-5784: Undefined Security Weakness

Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted data on a "3200+SYSNR" TCP port, as demonstrated by port 3201. NOTE: this issue can be leveraged by local users to...

CVE-2006-5785: Undefined Security Weakness

Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service enserver.exe crash via a 0x72F2 sequence on UDP port 64999...

SAP Web Application Server multiple security vulnerabilities

Directory traversal, DoS, local privilege escalation thorugh named pipe...

vulnerability details

Release Date: 03/01/2006 Affected Applications: SAP WebAS Kernel up to version 7.00 Affected Platforms: Platform-Independant Local / Remote: Remote Severity: Medium to High Author: A. Grossmann arnold.grossmann at gmail.com Vendor Status: Confirmed Product Overview cited from SAP :...

SAP Web Application Server crossite scripting

Crossite scripting with error messages...

CVE-2006-1039

SAP Web Application Server WebAS Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers...

Authentication flaw

SAP Web Application Server WebAS Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers...

CVE-2006-1039

CVE-2006-1039 affects the SAP Web Application Server (WebAS) Kernel prior to 7.0. The vulnerability allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information (and potentially other impacts) by exploiting a ";%20" sequence followed by ...

CVE-2006-1039: Improper Control of Generation of Code

SAP Web Application Server WebAS Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers...

SAP Web Application Server crossite scripting

No description provided...

CVE-2005-3633

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter...

CVE-2005-3635

Multiple cross-site scripting XSS vulnerabilities in SAP Web Application Server WAS 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via 1 the sap-syscmd in sap-syscmd and 2 the BspApplication field in the SYSTEM PUBLIC test application...

CVE-2005-3636

Cross-site scripting XSS vulnerability in SAP Web Application Server WAS 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages...

CVE-2005-3633

The CVE-2005-3633 entry describes an HTTP response splitting vulnerability in SAP Web Application Server (WAS) 6.10 through 7.00. The issue affects frameset.htm, allowing remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter. The vulnerability’s root cause is improper ha...

CVE-2005-3634

SAP Web Application Server (WAS) 6.10–7.00 is affected by an open redirect in frameset.htm of the BSP runtime. A remote attacker can cause users to log out and be redirected to arbitrary sites by manipulating sap-sessioncmd (close) and sap-exiturl parameters. The vulnerability is tied to the BSP ...

CVE-2005-3633

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter...

CVE-2005-3635

Multiple cross-site scripting XSS vulnerabilities in SAP Web Application Server WAS 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via 1 the sap-syscmd in sap-syscmd and 2 the BspApplication field in the SYSTEM PUBLIC test application...

CVE-2005-3636

The vulnerability CVE-2005-3636 is an XSS flaw in SAP Web Application Server (WAS) 6.10 that allows remote attackers to inject arbitrary web script or HTML through Error Pages. The NVD entry notes a MEDIUM severity (CVSS2: AV:N/AC:M/Au:N/C:N/I:P/A:N) with a partial integrity impact. No exploit de...