CVE-2016-3976

CVE-2016-3976 affects SAP NetWeaver AS Java versions 7.1–7.5. The vulnerability is a directory traversal in the AS Java Monitoring/CrashFileDownloadServlet component, exploitable remotely via a ..\ in the fileName parameter to read arbitrary files on the server. Public references point to SAP Sec...

CVE-2016-3975

Cross-site scripting XSS vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP...

CVE-2016-3975

Cross-site scripting XSS vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP...

CVE-2016-3974

XML external entity XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to tcmonitoringwebserviceweb/ServerNodesWSService, aka SA...

CVE-2016-3974

XML external entity XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to tcmonitoringwebserviceweb/ServerNodesWSService, aka SA...

CVE-2016-3973

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

CVE-2016-3973

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

Security feature bypass

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

Xxe

XML external entity XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to tcmonitoringwebserviceweb/ServerNodesWSService, aka SA...

CVE-2016-3975

Cross-site scripting XSS vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP...

CVE-2016-3975

SAP NetWeaver AS Java 7.1–7.5 is affected by a cross-site scripting (XSS) vulnerability (CVE-2016-3975) that can be exploited remotely via the NavigationURLTester endpoint to inject arbitrary script/HTML. Affected component is the SAP NetWeaver AS Java application server; root cause relates to th...

CVE-2016-3973

Affected software: SAP NetWeaver AS Java RTC chat feature (WD_CHAT) in RTC 7.3–7.4 (likely 7.1–7.5). Root cause / vulnerability: Information disclosure via a crafted HTTP interaction with the chat UI; an anonymous attacker can access user information by navigating to webdynpro/resources/sap.com/t...

CVE-2016-3974

XML external entity XXE vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to tcmonitoringwebserviceweb/ServerNodesWSService, aka SA...

CVE-2016-3974

CVE-2016-3974 affects SAP NetWeaver AS JAVA 7.1–7.5. An XML External Entity (XXE) vulnerability in the Configuration Wizard/ctcprotocol servlet allows remote attackers to cause a denial of service, perform SMB relay actions, or read arbitrary files via a crafted XML to the ServerNodesWSService en...

CVE-2016-3973

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

CVE-2016-3976

Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971. Recent assessments: Assessed Attacker Value: 0 Assessed...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to read arbitrary files.

The vulnerability of the Manufacturing Integration and Intelligence xMII component of the SAP NetWeaver software integration platform is related to deficiencies in name-based path restrictions. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to gain access to protected information

The vulnerability of the Universal Worklist Configuration component of the SAP NetWeaver software integration platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a...

The vulnerability of the SAP NetWeaver software integration platform allows a hacker to inject any Web or HTML code.

The vulnerability of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...

PT-2016-3362 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA version 7.5 Description: The issue is related to an XML External Entity XXE vulnerability in the BC-BMT-BPM-DSK component of SAP NetWeaver AS JAVA. This vulnerability allows remote authenticated users to conduct XXE...