Exploit for Path Traversal in Sap Customer_Relationship_Management

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Comma...

CVE-2018-2371: Improper Neutralization of Input During Web Page Generation

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...

PT-2018-15504

Name of the Vulnerable Software and Affected Versions SAP Netweaver AS Java Web Application version 7.50 Description The SAML 2.0 service provider does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. Recommendations For SAP Netweaver AS Java Web...

CVE-2017-14581: Undefined Security Weakness

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service service crash via a crafted request, aka SAP Security Note 2389181...

PT-2017-13558

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA versions 7.0 through 7.5 Description The issue allows remote attackers to cause a denial of service, resulting in a service crash, via a crafted request to the Host Control web service. Recommendations For SAP NetWeaver A...

CVE-2017-11457

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

Server side request forgery (ssrf)

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

CVE-2017-11457

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

CVE-2017-11458: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783...

CVE-2017-11457: Improper Restriction of XML External Entity Reference

XML external entity XXE vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249...

PT-2017-12025

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.5 Description The issue allows remote authenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request. This is an XML external entity XXE...

PT-2017-12026

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the sessionID parameter in the ctcprotocol/Protocol servlet. This could potentially lea...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

CVE-2017-8913: Improper Restriction of XML External Entity Reference

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

PT-2017-18618

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.5 Description The issue allows remote authenticated users to conduct XML External Entity XXE attacks. This is achieved by sending a crafted XML document in a request to the...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

Sql injection

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

CVE-2017-7717: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504...

PT-2017-17903

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java version 7.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is due to a SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component. Recommendatio...

CVE-2016-10304

The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service out-of-memory error and service instability via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788...