319 matches found
CVE-2016-9563: Improper Restriction of XML External Entity Reference
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via the sap.comtcbpemhimuwlconnproviderweb/bpemuwlconn URI, aka SAP Security Note 2296909...
SAP NetWeaver AS JAVA - 'BC-BMT-BPM-DSK' XML external entity injection vulnerability
1 It is possible, that an attacker can perform a DoS attack for example, an XML Entity expansion attack 2 An SMB Relay attack is a type of man-in-the-middle attack where an attacker asks a victim to authenticate to a machine controlled by the attacker, then relays the credentials to the target. T...
SAP NetWeaver AS JAVA 7.4 XXE Injection
Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: http://SAP.com Bug: XXE Sent: 09.03.2016 Reported: 10.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2296909 Author: Vahagn Vardanyan ERPScan Descripti...
PowerShellEmpire Arbitrary File Upload (Skywalker)
A vulnerability existed in the new Empire maintained by BC Security prior to commit e73e883 use exploit/linux/http/empire/skywalker msf undefinedskywalker show actions ...actions... msf undefinedskywalker set ACTION msf undefinedskywalker show options ...show and set options... msf...
Algolia: Possilbe Sub Domain takever at prestashop.algolia.com
Hey Sir It looks like prestashop.algolia.com has a A record pointing to 178.62.8.144 But when you visit prestashop.algolia.com you see a page hosted by "BC WebSolution" and I couldn't find any relation with Algolia Now what's suspicious here is http://178.62.8.144/ also serves the content of "BC...
SAP NetWeaver AS JAVA - XXE vulnerability in BC-BMT-BPM-DSK component (CVE-2016-9563)
Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.5 Vendor URL: SAP Bugs: XXE Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2296909 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XXE...
CVE-2015-5076
Multiple cross-site scripting XSS vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or HTML via the 1 version parameter in protected/views/admin/formEditor.php; the 2 importId parameter in protected/views/admin/rollbackImport.php; the 3 bc, 4 fg,...
CVE-2014-4009
CVE-2014-4009 affects SAP CCMS Monitoring (BC-CCM-MON), where hardcoded credentials enable remote attackers to obtain access via unspecified vectors. The connected sources confirm the issue but do not provide product versions, affected components beyond BC-CCM-MON, or explicit remediation steps i...
CVE-2014-3130: Undefined Security Weakness
The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...
CVE-2014-1964
CVE-2014-1964 is an XSS vulnerability in the SAP NetWeaver Integration Repository (BC-XI) component of SAP Exchange Infrastructure. The issue affects the Integration Repository via the ESR application and a DIR error, enabling remote attackers to inject arbitrary web script or HTML. The NVD notes...
CVE-2014-1964
Cross-site scripting XSS vulnerability in the Integration Repository in the SAP Exchange Infrastructure BC-XI component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error...
SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ This module is based on, inspired by, or is a port of a...
SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ This module is based on, inspired by, or is a port of a...
Cross site scripting
Cross-site scripting XSS vulnerability in the Web GUI in SAP Web Application Server WAS 7.0, Web Dynpro for ABAP aka WD4A or WDA, and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under bc/gui/sap/its/webgui/...
CVE-2008-2421: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Web GUI in SAP Web Application Server WAS 7.0, Web Dynpro for ABAP aka WD4A or WDA, and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under bc/gui/sap/its/webgui/...
SAP Web Application Server crossite scripting
Crossite scripting with /sap/bc/gui/sap/its/webgui/...
CVE-2007-3495: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in the SAP Internet Communication Framework BC-MID-ICF in the SAP Basis component 700 before SP12, and 640 before SP20, allow remote attackers to inject arbitrary web script or HTML via certain parameters associated with the default login error pa...
CYBSEC-SAPBC2.txt
The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSECSecurityAdvisoryArbitraryFileReadorDeleteinSAPBC.pdf CYBSEC S.A. www.cybsec.com Advisory Name: Arbitrary File Read/Delete in SAP BC Business Connector Vulnerability Class: Improper Input...
CYBSEC - Security Pre-Advisory: Phishing Vector in SAP BC
The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSECSecurityPre-AdvisoryPhishingVectorinSAPBC.pdf CYBSEC S.A. www.cybsec.com Pre-Advisory Name: Phishing Vector in SAP BC Business Connector Vulnerability Class: Phishing Vector / Improper Input...