CVE-2023-28725

General Bytes Crypto Application Server CAS 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March...

CVE-2023-28725

CVE-2023-28725 affects General Bytes Crypto Application Server (CAS) versions 20230120 (distributed with BATM devices). The vulnerability allows an unauthenticated remote attacker to execute arbitrary Java code by uploading a Java app to the "/batm/app/admin/standalone/deployments" directory, due...

General Bytes Crypto Application Server 代码问题漏洞

General Bytes Crypto Application Server is a General Bytes company that provides powerful and simple browser-based administration. A security vulnerability exists in General Bytes Crypto Application Server CAS version 20230120. An attacker can exploit this vulnerability to execute arbitrary Java...

Security Bulletin: Vulnerability in IBM WebSphere Application Server (CVE-2023-23477) shipped with IBM Workload Scheduler 9.4

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Workload Scheduler, which results in IBM Workload Scheduled being impacted by this vulnerability. IBM WebSphere Application Server traditional is vulnerable to a remote code execution vulnerability. This has been...

SAP NetWeaver AS Input Validation Error Vulnerability (CNVD-2023-28124)

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. SAP NetWeaver AS suffers from an input validation error vulnerability, which stems from faulty input control and can be exploited by an attack...

SAP NetWeaver AS Java Access Control Error Vulnerability

SAP NetWeaver AS Java is a German SAP SAP company provides a Java runtime environment for the application server. The product is mainly used to develop and run Java EE applications. An access control error vulnerability exists in SAP NetWeaver AS Java version 7.50, which stems from the fact that ...

SAP NetWeaver AS Licensing Issue Vulnerability

SAP NetWeaver AS is a SAP Web Application Server from SAP Germany. It not only provides network services, but also is the basic platform for SAP software. SAP NetWeaver AS version 7.50 has an authorization problem vulnerability, which stems from the lack of authentication checks and can be...

CVE-2023-27896

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability...

CVE-2023-27271

In SAP BusinessObjects Business Intelligence Platform Web Services - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability...

Code injection

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability...

CVE-2023-26460

Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity...

Input validation

Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to ...

CVE-2023-27896 Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability...

CVE-2023-27896 Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform

In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability...

CVE-2023-27271 Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platform

In SAP BusinessObjects Business Intelligence Platform Web Services - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability...

CVE-2023-27270

SAP NetWeaver Application Server for ABAP and ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791) is affected by a Denial of Service vulnerability where an attacker authenticated as a non-administrative user can craft a request with specific parameters to...

CVE-2023-27269

SAP NetWeaver AS ABAP/ABAP Platform (versions 700–757, 791) is affected by CVE-2023-27269, a directory-traversal flaw in an available service that lets an attacker with non-administrative authorizations overwrite operating system files, potentially rendering the system unavailable. The flaw is de...

CVE-2023-26460

The CVE-2023-26460 entry concerns the Cache Management Service of SAP NetWeaver Application Server for Java, version 7.50. The underlying issue is that this component does not perform authentication for functionalities that require user identity, enabling potential unauthorized operations. Affect...

CVE-2023-26459 Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to ...

CVE-2023-24526

CVE-2023-24526 affects SAP NetWeaver Application Server Java for Classload Service 7.50. The vulnerability is an authentication bypass: functions that require user identity lack checks, enabling privilege escalation and exposing non-sensitive server data to unassigned users. The issue is document...