Security feature bypass

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

CVE-2016-3975

Cross-site scripting XSS vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP...

CVE-2016-3973

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

CVE-2016-3975

SAP NetWeaver AS Java 7.1–7.5 is affected by a cross-site scripting (XSS) vulnerability (CVE-2016-3975) that can be exploited remotely via the NavigationURLTester endpoint to inject arbitrary script/HTML. Affected component is the SAP NetWeaver AS Java application server; root cause relates to th...

CVE-2016-3973

Affected software: SAP NetWeaver AS Java RTC chat feature (WD_CHAT) in RTC 7.3–7.4 (likely 7.1–7.5). Root cause / vulnerability: Information disclosure via a crafted HTTP interaction with the chat UI; an anonymous attacker can access user information by navigating to webdynpro/resources/sap.com/t...

CVE-2016-3974

CVE-2016-3974 affects SAP NetWeaver AS JAVA 7.1–7.5. An XML External Entity (XXE) vulnerability in the Configuration Wizard/ctcprotocol servlet allows remote attackers to cause a denial of service, perform SMB relay actions, or read arbitrary files via a crafted XML to the ServerNodesWSService en...

CVE-2016-3974

XML external entity XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to tcmonitoringwebserviceweb/ServerNodesWSService, aka SA...

CVE-2016-3976

Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971. Recent assessments: Assessed Attacker Value: 0 Assessed...

The vulnerability of the SAP NetWeaver software integration platform allows a hacker to inject any Web or HTML code.

The vulnerability of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to gain access to protected information

The vulnerability of the Universal Worklist Configuration component of the SAP NetWeaver software integration platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to read arbitrary files.

The vulnerability of the Manufacturing Integration and Intelligence xMII component of the SAP NetWeaver software integration platform is related to deficiencies in name-based path restrictions. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

PT-2016-3362 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA version 7.5 Description: The issue is related to an XML External Entity XXE vulnerability in the BC-BMT-BPM-DSK component of SAP NetWeaver AS JAVA. This vulnerability allows remote authenticated users to conduct XXE...

The vulnerability of the SAP NetWeaver software integration platform allows a hacker to execute arbitrary SQL commands.

The vulnerability of the UDDI server component of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

SAP NetWeaver Manufacturing Integration and Intelligence Catalog Traversal Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications.Manufacturing Integration and Intelligence also known as MII, formerly known as xMII is one of the core...

SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2016-01150)

SAP NetWeaver is SAP SAP company's set of service-oriented integrated application platform. A cross-site scripting vulnerability exists in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver version 7.4. A remote attacker can exploit this vulnerability to inject arbitrary web script or HT...

SAP NetWeaver Information Disclosure Vulnerability (CNVD-2016-01148)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in the Universal Worklist Configuration of SAP NetWeaver version 7.4. A remote...

SAP NetWeaver J2EE Engine UDDI Server SQL Injection Vulnerability

SAP NetWeaver J2EE Engine is the German SAP SAP company's a service-oriented integrated application platform J2EE engine. A SQL injection vulnerability exists in the UDDI server of SAP NetWeaver J2EE Engine version 7.40. A remote attacker could exploit this vulnerability to execute arbitrary SQL...

CVE-2016-2388

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846...

CVE-2016-2387

Multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 ns or 2 interface parameter to ProxyServer/register, aka SAP Security Note 2220571...

CVE-2016-2387

Multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 ns or 2 interface parameter to ProxyServer/register, aka SAP Security Note 2220571...