The vulnerability of the SAP NetWeaver software integration platform allows a hacker to obtain information about the integration platform and the operating system.

The vulnerability of the SAP NetWeaver integration platform exists due to the lack of restrictions on remote invocation of the GetSystemInstanceList function. Exploiting this vulnerability allows a malicious actor to obtain information about the integration platform and the operating system throu...

[ERPSCAN-15-003] SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS

ERPSCAN Research Advisory ERPSCAN-15-003 SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS Application: SAP NetWeaver Dispatcher Versions Affected: SAP NetWeaver Dispatcher, probably others Vendor URL: http://SAP.com Bugs: RCE Sent: 25.08.14 Reported: 25.08.14 Vendor response: 25.08.14 Date of...

[ERPSCAN-15-004] SAP NetWeaver Portal XMLValidationComponent - XXE

ERPSCAN Research Advisory ERPSCAN-15-004 SAP NetWeaver Portal XMLValidationComponent - XXE Application: SAP NetWeaver Portal 7.31 Versions Affected: SAP NetWeaver Portal 7.31, probably others Vendor URL: http://SAP.com Bugs: XML eXternal Entity Sent: 06.11.2014 Reported: 06.11.2014 Vendor respons...

[ERPSCAN-15-006] SAP NetWeaver Portal ReportXmlViewer - XXE

ERPSCAN Research Advisory ERPSCAN-15-006 SAP NetWeaver Portal ReportXmlViewer - XXE Application: SAP NetWeaver Portal 7.31 Versions Affected: SAP NetWeaver Portal 7.31, probably others Vendor URL: http://SAP.com Bugs: XXE Sent: 09.12.2014 Reported: 09.12.2014 Vendor response: 10.12.2014 Date of...

SAP NetWeaver Gain Privilege Vulnerability

SAP NetWeaver is Germany SAP SAP company's set of service-oriented integrated application platform, the platform can provide development and operation environment for SAP applications. A privilege acquisition vulnerability exists in SAP NetWeaver that allows remote attackers to gain access via...

CVE-2015-5067

The 1 Cross-System Tools and 2 Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982...

Hardcoded credentials

The 1 Cross-System Tools and 2 Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982...

CVE-2015-5067

The 1 Cross-System Tools and 2 Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982...

CVE-2015-5067

The CVE-2015-5067 entry affects SAP NetWeaver, specifically the Cross-System Tools and Data Transfer Workbench components. The root cause is hardcoded credentials within these tools, enabling remote access via unspecified vectors. This is supported by multiple sources (NVD/CNVD/PRION/CVE lists) r...

CVE-2015-5067

The 1 Cross-System Tools and 2 Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982...

SAP NetWeaver Application Server Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

SAP HANA Encryption Vulnerabilities

SAP’s in-memory relational database management system, HANA, contains a whopper of a security weakness: a default encryption key guarding passwords, stored data and backups. Researchers from ERPScan, which recently uncovered serious configuration vulnerabilities in Oracle PeopleSoft products, on...

SAP NetWeaver Portal ConfigServlet Remote Command Execution

A remote command execution vulnerability has been reported in SAP NetWeaver. The vulnerability is due to insufficient validation in SAP ConfigServlet handling of incoming GET requests. By sending a specially-crafted GET request, an attacker could exploit this vulnerability to inject and execute...

CVE-2015-2282

Stack-based buffer overflow in the LZC decompression implementation CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows...

Out-of-bounds

The LZH decompression implementation CsObjectInt::BuildHufTree function in vpa108csulzh.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers t...

CVE-2015-2282

CVE-2015-2282 is a stack-based buffer overflow in SAP’s LZC/LZH decompression code used across SAP MaxDB 7.5/7.6, NetWeaver AS ABAP/Java, RFC/GUI SDKs, SAPCAR, and related tools. The flaw (CsObjectInt::CsDecomprLZC and related LZH handling) can cause denial of service (crash) and may allow arbitr...

SAP NetWeaver AS Java XML External Entity Vulnerability

SAP NetWeaver is SAP's software base platform, divided into SAP Netweaver JAVA and Netweaver ABAP. Its predecessor is SAP BASIS components. Because of the development of the Internet and JAVA, SAP adjusted the architecture of the basic platform, adding support for JAVA, but also to enhance the...

CVE-2015-4091

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

Xxe

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2015-4091

CVE-2015-4091 describes an XML External Entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4. The issue arises when the SAP XML parser at /sap.com/tc~sld~wd~main/Main processes incoming XML requests with a user-specified DTD (CIM UPLOAD), potentially allowing remote attackers to send TCP reque...