PT-2016-20: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "FloorPlanApp" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How to...

PT-2016-24: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "TranslationSupport" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. H...

PT-2016-26: XML External Entity Injection in SAP NetWeaver

The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in SAP NetWeaver. Vulnerability in the "YWorksLayouter" component allows attackers to obtain sensitive information or cause a denial of service using a specially crafted XML request. How t...

PT-2016-18: Directory Traversal in SAP NetWeaver

The specialists of the Positive Research center have detected a Directory Traversal vulnerability in SAP NetWeaver. The vulnerability was found in the "Log Viewer" component. The attacker can upload malformed archive that contains files with special characters in their names. When the Web...

PT-2016-19: Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in SAP NetWeaver. Vulnerability in the MembersApp component allows attackers to enumerate usernames by observing timing differences between responses sent for valid and invalid usernames. How to...

PT-2016-16: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Stored XSS in the UpdateThemeVersionPortalComponent of the Web Application, related to unsafe storage of user input in the log file, allows attackers to execute malicious code if t...

PT-2016-17: Cross-Site Scripting in SAP NetWeaver

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in SAP NetWeaver. Reflected cross-site scripting in the "/com.sap.portal.themes.styleservice.LockingTestPortalComponent" component allows remote attackers to inject arbitrary HTML tags including...

SAP NetWeaver AS JAVA - XXE vulnerability in BC-BMT-BPM-DSK component (CVE-2016-9563)

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.5 Vendor URL: SAP Bugs: XXE Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2296909 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XXE...

SAP NetWeaver - buffer overflow vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.0-7.5 Vendor URL: SAP Bugs: buffer overflow Reported: 09.03.2016 Vendor response: 10.03.2016 Date of Public Advisory: 12.07.2016 Reference: SAP Security Note 2295238 Author: Dmitry Yudin ERPScan VULNERABILITY INFORMATION Class: Denial ...

SAP TREX Remote Command Execution Vulnerability

SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. A remote command execution vulnerability exists in version 7.10 of SAP TREX that could be exploited by an attacker to execute arbitrary code in the context of an affected application...

SAP NetWeaver AS JAVA Denial of Service Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications.SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language. A denial of service vulnerability...

SAP NetWeaver SAPSTARTSRV Remote Buffer Overflow Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications. A remote buffer overflow vulnerability exists in SAP NetWeaver SAPSTARTSRV due to the program failing to adequately filter the bounds-check parameter. An...

SAP NetWeaver Application Server Java XML External Entity Denial of Service Vulnerability

SAP NetWeaver Application Server AS Java is an application server that runs in NetWeaver and is based on the Java programming language. A denial of service vulnerability exists in SAP NetWeaver Application Server Java. An attacker could exploit the vulnerability to cause a denial of service...

SAP NetWeaver AS ABAP Directory Traversal Vulnerability

SAP Netweaver AS ABAP is an application server that runs in NetWeaver and is based on the ABAP high-level programming language. A directory traversal vulnerability exists in SAP NetWeaver AS ABAP. A failure of the program to properly filter user-supplied input allows a remote attacker to use a...

SAP NetWeaver Application Server Java Denial of Service Vulnerability

SAP NetWeaver Application Server AS Java is an application server that runs in NetWeaver and is based on the Java programming language. A denial of service vulnerability exists in SAP NetWeaver Application Server Java. An attacker could exploit the vulnerability to cause a denial of service...

SAP NetWeaver Application Server Java Directory Traversal Vulnerability

SAP NetWeaver Application Server AS Java is an application server that runs in NetWeaver and is based on the Java programming language. A directory traversal vulnerability exists in SAP NetWeaver Application Server Java. A failure of the program to properly filter user-supplied input allows a...

SAP TREX Arbitrary File Read Vulnerability

SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. An arbitrary file read vulnerability exists in SAP TREX, which can be exploited by a remote attacker to read arbitrary files in an affected application where the user resides...

SAP NetWeaver AS Java Information Disclosure Vulnerability (2255990) - Active Check

SAP NetWeaver Application Server AS Java is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SAP NetWeaver AS JAVA 7.4 XXE Injection

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: http://SAP.com Bug: XXE Sent: 04.12.2015 Reported: 05.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 12.04.2016 Reference: SAP Security Note 2254389 Author: Vahagn Vardanyan ERPScan Descripti...

The vulnerability of the SAP NetWeaver Application Server allows a perpetrator to compromise the security of information.

The vulnerability of SAP NetWeaver Application Server is related to errors in the processing of XML requests. Exploiting this vulnerability allows a malicious actor to compromise information security by sending specially crafted TCP and XML requests remotely...