SAP NetWeaver AS JAVA XSS in portal app component

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java RTC 7.0-7.3 Vendor URL: SAP Bugs: XSS Reported: 22.04.2016 Vendor response: 23.04.2016 Date of Public Advisory: 10.01.2017 Reference: SAP Security Note 2341302 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION...

SAP NetWeaver 7.5 Information disclosure + port scan in SLD test application

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver SLD Vendor URL: SAP Bugs: Information disclosure Reported: 22.04.2016 Vendor response: 23.04.2016 Date of Public Advisory: 08.11.2016 Reference: SAP Security Note 2342940 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION...

SAP NetWeaver AS ABAP - Directory traversal using READ DATASET

Application: SAP NetWeaver AS ABAP Versions Affected: SAP NetWeaver AS ABAP 7.4 Vendor URL: SAP Bugs: Directory traversal Reported: 22.04.2016 Vendor response: 23.04.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2312966 Author: Daria Prosochkina ERPScan VULNERABILITY...

SAP NetWeaver AS JAVA - deserialization of untrusted user value

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver 7.5 Vendor URL: SAP Bugs: Denial of Service Reported: 22.04.2016 Vendor response: 23.04.2016 Date of Public Advisory: 12.07.2016 Reference: SAP Security Note 2315788 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class:...

SAP NetWeaver AS JAVA icman - DoS vulnerability (CVE-2016-9562)

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: SAP Bugs: Denial of Service Reported: 22.04.2016 Vendor response: 23.04.2016 Date of Public Advisory: 09.08.2016 Reference: SAP Security Note 2313835 Author: Vahagn Vardanyan ERPScan VULNERABILITY...

SAP NetWeaver AS JAVA Enqueue Server Component Denial of Service Vulnerability

SAP NetWeaver is an integrated service-oriented application platform that provides a development and runtime environment for SAP applications.SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language.Enqueue Server is one of the SAP Enqueu...

SAP NetWeaver AS JAVA UDDI Component XML External Entity Reference Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications.SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language. An XML external entity reference...

CVE-2016-4015

The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service process crash via a crafted request, aka SAP Security Note 2258784...

CVE-2016-4014

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

CVE-2016-4014

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

Design/Logic Flaw

The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service process crash via a crafted request, aka SAP Security Note 2258784...

Xxe

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

CVE-2016-4015

CVE-2016-4015 is a DoS vulnerability in the SAP NetWeaver JAVA AS Enqueue Server. A crafted request in Enqueue Server (affecting SAP NetWeaver Enqueue Server 7.4 and likely earlier 7.1–7.4) can crash the process, enabling remote attackers to deny service. The issue is documented with SAP Security...

CVE-2016-4014

XML external entity XXE vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service system hang via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389...

CVE-2016-4014

The CVE-2016-4014 entry concerns an XXE/XEE vulnerability in the SAP NetWeaver AS JAVA UDDI component (SAP NetWeaver JAVA AS 7.4). The root cause is XML External Entity processing allowing a crafted DTD to cause denial of service by making the server hang when processing requests to uddi/api/repl...

CVE-2016-4015

The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service process crash via a crafted request, aka SAP Security Note 2258784...

SAP NetWeaver AS JAVA Internet Communication Manager Component Denial of Service Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications. SAP NetWeaver AS Application Server Java is an application server that runs in NetWeaver and is based on the Java programming language. Internet...

SAP NetWeaver AS JAVA Java Startup Framework Component Denial of Service Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications. SAP NetWeaver AS Application Server Java is an application server that runs in NetWeaver and is based on the Java programming language. Java...

Authorization

The XML Data Archiving Service XML DAS in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to 1 webcontent/cas/casenter.jsp, 2...

CVE-2015-8840

The XML Data Archiving Service XML DAS in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to 1 webcontent/cas/casenter.jsp, 2...