CVE-2024-47592: Improper Restriction of Excessive Authentication Attempts

SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability...

CVE-2024-42372: Missing Authorization

Due to missing authorization check in SAP NetWeaver AS Java System Landscape Directory an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application...

SAP NetWeaver AS Java XSS (3505503)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability. Note that Nessus has not tested for th...

CVE-2024-45280

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280: Improper Neutralization of Input During Web Page Generation

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

PT-2024-31534

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java affected versions not specified Description The issue is due to insufficient encoding of user-controlled inputs, allowing malicious scripts to be executed in the login application. This has a limited impact on...

CVE-2024-34688

Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availabilit...

CVE-2024-28164 Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)

SAP NetWeaver AS Java CAF - Guided Procedures allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application...

CVE-2024-28164

SAP NetWeaver AS Java (CAF - Guided Procedures) is affected by CVE-2024-28164, an information-disclosure vulnerability where an unauthenticated user can access non-sensitive server information that should be restricted. The issue is described across multiple sources as a low-impact confidentialit...

CVE-2024-34688

CVE-2024-34688 affects SAP NetWeaver AS Java where unrestricted access to the Meta Model Repository services can let attackers cause DoS, impacting availability with no confidentiality/integrity impact. Affected product: SAP NetWeaver AS Java (Meta Model Repository). Root cause: unrestricted acce...

CVE-2024-28164: Exposure of Sensitive Information to an Unauthorized Actor

SAP NetWeaver AS Java CAF - Guided Procedures allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application...

CVE-2024-34688: Uncontrolled Resource Consumption

Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availabilit...

CVE-2024-27899

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both...

CVE-2024-27899 Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both...

CVE-2024-27899

CVE-2024-27899 affects SAP NetWeaver AS Java, specifically the User Admin Application’s Self-Registration and profile modification function, which does not enforce proper security for the content of newly defined security answers. Root cause is a misconfiguration/weak security controls in user ma...

CVE-2024-27899: Weak Password Recovery Mechanism for Forgotten Password

Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both...

CVE-2024-22127

SAP NetWeaver Administrator AS Java Administrator Log Viewer plug-in - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on...

CVE-2024-22127 Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

SAP NetWeaver Administrator AS Java Administrator Log Viewer plug-in - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on...

CVE-2024-22127

CVE-2024-22127 affects SAP NetWeaver Application Server for Java (Administer Log Viewer plug-in) 7.50. A high-privilege attacker can upload potentially dangerous files, enabling command injection that can impact confidentiality, integrity, and availability. Root cause: file upload validation weak...