SAP NetWeaver Web Dynpro 6.4 7.5 - Information Disclosure

SAP NetWeaver Web Dynpro 6.4 7.5 - Information Disclosure Application: SAP NetWeaver Web Dynpro 6.4 to 7.5 - Information disclosure Versions Affected: SAP NetWeaver 6.4 - 7.5 Vendor URL: http://SAP.com Bugs: Information disclosure Enumerate users Sent: 2016-12-15 Reported: 2016-12-15 Date of Publ...

SAP NetWeaver 'SLC Sell Side Registration Page' Cross-Site Scripting Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver 'SLC Sell Side Registration Page', which stems from...

SAP Netweaver Cross-Site Scripting Vulnerability (CNVD-2018-12922)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide development and operation environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver, which stems from the program failing to properl...

SAP NetWeaver Adapter Engine Cache Monitor Information Disclosure Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver Adapter Engine Cache Monitor. An attacker could...

Spoofing

SAP NetWeaver Application Server Java Web Container and HTTP Service Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50 do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are...

CVE-2018-2415

SAP NetWeaver Application Server Java Web Container and HTTP Service Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50 do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are...

CVE-2018-2415

SAP NetWeaver Application Server Java Web Container and HTTP Service Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50 do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are...

CVE-2018-2415

SAP NetWeaver Application Server Java Web Container and HTTP Service Engine API, from 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50 do not sufficiently encode user controlled inputs, resulting in a content spoofing vulnerability when error pages are...

CVE-2018-2415

The CVE-2018-2415 issue affects SAP NetWeaver Application Server Java Web Container and HTTP Service (Engine API, 7.10–7.11, 7.30, 7.31, 7.40, 7.50; J2EE Engine Server Core 7.11, 7.30, 7.31, 7.40, 7.50). It arises from insufficient encoding of user-controlled inputs, leading to a content spoofing...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2018:0846-1)

This update for krb5 provides the following fixes: Security issues fixed : - CVE-2018-5730: DN container check bypass by supplying special crafted data bsc1083927. - CVE-2018-5729: NULL pointer dereference in kadmind or DN container check bypass by supplying special crafted data bsc1083926...

SAP NetWeaver RunTime Cross-Site Scripting Vulnerability

SAP NetWeaver RunTime is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver RunTime, which arises from the program's...

SAP NetWeaver AS JAVA CRM Log Injection Remote Command Execution

!/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning helpdesc = ''' PoC of Remote Command Execution via Log...

SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution

SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution !/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requests.packages.urllib3.exceptions import InsecureRequestWarning...

Cross site scripting

SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2365

SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2368

SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity...

CVE-2018-2365

SAP NetWeaver Portal, WebDynpro Java, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Authentication flaw

SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity...

CVE-2018-2368

SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity...

CVE-2018-2368

CVE-2018-2368 affects SAP NetWeaver System Landscape Directory (SLD) and LM-CORE versions 7.10, 7.20, 7.30, 7.31, 7.40, where functions that require user identity perform no authentication checks. The connected documents corroborate an authentication bypass vulnerability impacting SAP NetWeaver S...