Command injection

SAP NetWeaver Administrator AS Java Administrator Log Viewer plug-in - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on...

Authentication flaw

Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

Design/Logic Flaw

Under certain condition SAP NetWeaver Enterprise Portal - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application...

Cross site scripting

Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to...

CVE-2024-25645 Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)

Under certain condition SAP NetWeaver Enterprise Portal - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application...

CVE-2024-25645 Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)

Under certain condition SAP NetWeaver Enterprise Portal - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application...

CVE-2024-25645

The CVE-2024-25645 entry concerns SAP NetWeaver (Enterprise Portal) version 7.50, where an information disclosure vulnerability could permit access to restricted data, causing low confidentiality impact with no integrity/availability impact. The connected records confirm the affected product and ...

CVE-2024-28163 Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)

Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration PI - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

CVE-2024-28163 Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)

Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration PI - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

CVE-2024-28163

CVE-2024-28163 affects SAP NetWeaver Process Integration (PI) 7.50 where the Support Web Pages could reveal restricted information, resulting in low confidentiality impact with no integrity/availability impact. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, CVE listing, etc.) ...

CVE-2024-27902

CVE-2024-27902 affects SAP NetWeaver AS ABAP with SAP GUI for HTML, specifically versions 7.89 and 7.93. The root cause is insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting (XSS) vulnerability. Exploitation can allow a remote attacker to execute code in a user’s b...

CVE-2024-27902 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)

Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to...

CVE-2024-27902 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)

Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to...

CVE-2024-25644 Information Disclosure vulnerability in NetWeaver (WSRM)

Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

CVE-2024-25644

CVE-2024-25644 affects SAP NetWeaver WSRM 7.50. Under certain conditions, it allows an attacker to access information that would normally be restricted, yielding low impact on confidentiality and no impact on integrity or availability. The connected sources confirm the product and scope but do no...

CVE-2024-25644 Information Disclosure vulnerability in NetWeaver (WSRM)

Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application...

CVE-2024-22127 Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

SAP NetWeaver Administrator AS Java Administrator Log Viewer plug-in - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on...

CVE-2024-22127 Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

SAP NetWeaver Administrator AS Java Administrator Log Viewer plug-in - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on...

CVE-2024-22127

CVE-2024-22127 affects SAP NetWeaver Application Server for Java (Administer Log Viewer plug-in) 7.50. A high-privilege attacker can upload potentially dangerous files, enabling command injection that can impact confidentiality, integrity, and availability. Root cause: file upload validation weak...

SAP NetWeaver 代码注入漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A file upload vulnerability exists in SAP NetWeaver, which stems from the application's lack of effective...