CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java 非同期化の脆弱性 説明 CVE-2021-38163 は SAP NetWeaver Application Server AS Java におけるセキュリティ脆弱性であり、認証済みの攻撃者がサーバーに 任意のファイルをアップロード でき、最終的に リモートコード実行 RCE につながる可能性があります。 この問題は、Visual Composer Migration Service com.sap.visualcomposer.VCParMigrator...

CVE-2021-21337

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:40+00:00| seen| https://t.me/hackingAttack/11108 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/11108 2026-09-08 05:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/11108 2026-09-09 00:00:41+00:00|...

EUVD-2017-14476

Malware in sbrugna...

EUVD-2017-16672

Malware in sbrugna...

EUVD-2020-19352

Malware in sbrugna...

EUVD-2016-1489

Malware in sbrugna...

EUVD-2024-42536

Malicious code in bioql PyPI...

CVE-2025-42922: Improper Control of Generation of Code

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42927: Dependency on Vulnerable Third-Party Component

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42925: Predictable from Observable State

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2023-42480

The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability...

CVE-2021-27598

SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...

CVE-2020-6224

SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure...

CVE-2020-6286

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal...

CVE-2020-26820

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate...

CVE-2025-0057 Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application)

SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...

CVE-2025-0057

CVE-2025-0057 concerns SAP NetWeaver AS Java (User Admin Application). The issue is a stored cross-site scripting vulnerability where an attacker, posing as an admin, can upload a photo containing malicious JavaScript. When a victim accesses the vulnerable component, the attacker can read and mod...

CVE-2025-0057: Unrestricted Upload of File with Dangerous Type

SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...

CVE-2024-47582 XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application...

PT-2024-9407 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java affected versions not specified Description: The issue allows an attacker authenticated as an administrator to use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an...