CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java 反同步漏洞 描述 CVE-2021-38163 是 SAP NetWeaver Application Server AS Java 中的一个安全漏洞，允许经过身份验证的攻击者 上传任意文件 到服务器，可能导致 远程代码执行 RCE 。 该问题源于 Visual Composer 迁移服务 com.sap.visualcomposer.VCParMigrator 中的访问控制不当，未能正确验证文件路径。攻击者可以通过以下方式加以利用： 路径遍历 ：绕过目录限制，将文件写入预期位置之外 JSP 上传 ：部署恶意的...

CVE-2021-21337

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:40+00:00| seen| https://t.me/hackingAttack/11108 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/11108 2026-09-08 05:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/11108 2026-09-09 00:00:41+00:00|...

EUVD-2017-14476

Malware in sbrugna...

EUVD-2017-16672

Malware in sbrugna...

EUVD-2020-19352

Malware in sbrugna...

EUVD-2016-1489

Malware in sbrugna...

EUVD-2024-42536

Malicious code in bioql PyPI...

CVE-2025-42927: Dependency on Vulnerable Third-Party Component

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42922: Improper Control of Generation of Code

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42925: Predictable from Observable State

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2023-42480

The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability...

CVE-2021-27598

SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...

CVE-2020-6224

SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure...

CVE-2020-6286

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal...

CVE-2020-26820

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate...

CVE-2025-0057 Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application)

SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...

CVE-2025-0057

CVE-2025-0057 concerns SAP NetWeaver AS Java (User Admin Application). The issue is a stored cross-site scripting vulnerability where an attacker, posing as an admin, can upload a photo containing malicious JavaScript. When a victim accesses the vulnerable component, the attacker can read and mod...

CVE-2025-0057: Unrestricted Upload of File with Dangerous Type

SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...

CVE-2024-47582 XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application...

PT-2024-9407 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java affected versions not specified Description: The issue allows an attacker authenticated as an administrator to use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an...