RFC modules in developing Information Disclosure

The vulnerability of RFC software modules for developing and executing applications in the ABAP SAP NetWeaver Application Server ABAP environment is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to disclose the protected information...

ABAP Application Server Buffer Overflow

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to writing beyond buffer boundaries. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access t...

ABAP SAP NetWeaver Privilege Escalation

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

ABAP Application Server Code Execution

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ABAP Application Server XSS

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...

CVE-2025-42929

CVE-2025-42929 describes a missing input validation vulnerability in SAP Landscape Transformation Replication Server (ABAP reports). The root cause is insufficient input validation in a component handling ABAP reports, allowing a high-privilege attacker to delete the content of arbitrary database...

CVE-2025-42976

SAP NetWeaver Application Server ABAP BIC Document allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can...

SAP NetWeaver Application Server ABAP code injection vulnerability

SAP NetWeaver Application Server ABAP is an application server developed by SAP to run ABAP applications. An HTML injection vulnerability exists in SAP NetWeaver Application Server ABAP. An attacker could exploit this vulnerability to construct URLs containing malicious scripts that could be...

ABAP SQL Injection

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitra...

ABAP SAP NetWeaver Application Server System Information Disclosure

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to the disclosure of system data that is not protected by permissions within the controlled area. Exploiting this vulnerability can allow a...

ABAP Application Server Authentication Bypass Info Disclosure

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in SAP NetWeaver, ABAP, Web Dispatcher, Business Objects, HCM and Commerce Cloud. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: - Cross-Site Scripting XSS. - Server-Side Request Forgery SSRF. ...

CVE-2024-24740

SAP NetWeaver Application Server ABAP - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of t...

SAP NetWeaver AS input validation error vulnerability

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. An input validation error vulnerability exists in SAP NetWeaver AS for ABAP and ABAP Platform. An attacker could use this vulnerability to redirect...

ABAP SAP NetWeaver Authentication Bypass

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to the bypassing of the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthoriz...

CVE-2021-27611

SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service...

CVE-2021-27603

An RFC enabled function module SPIWAITMILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the...

SAP NetWeaver AS ABAP Information Disclosure Vulnerability (CNVD-2020-65558)

SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming from SAP, Germany. An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP POWL test application versions 710, 711, 730, 731, 740, and 750. An attacker...