CVE-2018-2435

SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2435

SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

Spoofing

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver UIInfra, 1.0, SAP UI Implementation for Decoupled Innovations UI700, 2.0: SAP NetWeaver 7.00 Implementation,...

CVE-2018-2434

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver UIInfra, 1.0, SAP UI Implementation for Decoupled Innovations UI700, 2.0: SAP NetWeaver 7.00 Implementation,...

CVE-2018-2434

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver UIInfra, 1.0, SAP UI Implementation for Decoupled Innovations UI700, 2.0: SAP NetWeaver 7.00 Implementation,...

Cross site scripting

SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2435

SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2018-2434

CVE-2018-2434 describes a content-spoofing vulnerability in SAP UI components (UI_Infra 1.0, UI_700 2.0; SAP_UI 7.4/7.5/7.51/7.52) used with SAP NetWeaver 7.00. The issue allows rendering HTML pages containing arbitrary plain text content, potentially misleading end users, but does not allow embe...

CVE-2018-2435

CVE-2018-2435 affects SAP NetWeaver Enterprise Portal versions 7.0–7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50. The issue is a Cross-Site Scripting (XSS) vulnerability caused by insufficient encoding of user-controlled inputs. The connected documents confirm the affected product scope and vulnerabil...

CVE-2018-2434

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver UIInfra, 1.0, SAP UI Implementation for Decoupled Innovations UI700, 2.0: SAP NetWeaver 7.00 Implementation,...

Design/Logic Flaw

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...

CVE-2018-2428

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

Design/Logic Flaw

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

CVE-2018-2424

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...

CVE-2018-2428

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. Software components affected are: SAP Infrastructure 1.0, SAP UI 7.4, 7.5, 7.51, 7.52 and version 2.0 of SAP UI for SAP NetWeaver 7.00...

SAP NetWeaver AS Java Log Injection Security Bypass Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide the development and operation environment for SAP applications. SAP NetWeaver AS Application Server Java is a run in NetWeaver and based on the Java programming language...

SAP NetWeaver Instance Agent Service Information Disclosure Vulnerability (CNVD-2018-15773)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver. An attacker could exploit this vulnerability to...

Unspecified Content Spoofing Vulnerability in SAP NetWeaver Application Server Java Web Container and HTTP Service

SAP NetWeaver is Germany's SAP SAP company's set of service-oriented integrated application platform, the platform can provide development and operation environment for SAP applications. Application Server Java Web Container is one of the Java application running environment; HTTP Service is an...

SAP Netweaver Web Dynpro ABAP Denial of Service Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A denial of service vulnerability exists in SAP Netweaver Web Dynpro ABAP. An attacker could exploit this...

SAP NetWeaver Open Redirect Vulnerability (CNVD-2018-14851)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An open redirection vulnerability exists in SAP NetWeaver. An attacker can exploit the vulnerability to cause a...