Code injection

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...

CVE-2014-3787

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration SAP CUA tables via unspecified vectors...

CVE-2014-3787

CVE-2014-3787 affects SAP NetWeaver 7.20 and earlier. Multiple connected sources confirm that remote attackers can read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors. The CVSS estimate in NVD indicates a network-accessible, low-complexity漏洞 with partial confid...

SAP NetWeaver Dispatcher Buffer Overflow - RCE, DoS

Application: SAP NetWeaver Dispatcher Versions Affected: SAP KERNEL 7.00 32BIT, disp+work.exe 7000.52.12.34966 SAP KERNEL 7.20 64BIT, disp+work.exe 7200.117.19.50294 Vendor URL: Bugs: Buffer overflow CWE-119 CVSS according to ERPScan: AV:N/AC:H/Au:S/C:C/I:C/A:C 7.1 CVSS according to SAP:...

CVE-2014-3133

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

CVE-2014-3130

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2014-3129

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

Design/Logic Flaw

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

Design/Logic Flaw

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

Design/Logic Flaw

The Java Server Pages in the Software Lifecycle Manager SLM in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1...

CVE-2014-3130

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2014-3130

Technical details (affected product/version, root cause, exploit information) are not provided in the supplied documents for CVE-2014-3130; monitor for updates.

CVE-2014-3133

CVE-2014-3133 affects SAP NetWeaver Java Application Server. The issue is improper access restriction that allows remote attackers to retrieve the list of SAP systems registered on an SLD via an unspecified Web Dynpro component, related to SystemSelection. The vulnerability implies information di...

CVE-2014-3133

SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection...

CVE-2014-3129

CVE-2014-3129 relates to SAP NetWeaver’s Software Lifecycle Manager (SLM) Java Server Pages, where the JSP component handles a crafted request that can lead to information disclosure. Affected product area is SAP Solution Manager 7.1. The description in the connected sources confirms an informati...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

CVE-2013-7364

SAP NetWeaver’s J2EE Engine contains an unspecified J2EE core service that does not properly restrict access. This allows remote attackers to read and write to arbitrary files via unknown vectors. Affected component: J2EE Engine (SAP NetWeaver). Root cause: inadequate access restrictions in a cor...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

PT-2014-09: Sensitive Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in SAP NetWeaver. An attacker can read any tables from SAP Central User Administration SAP CUA via accessing the system affiliated with SAP CUA. How to fix Update your software up to the...

CVE-2014-1964

Cross-site scripting XSS vulnerability in the Integration Repository in the SAP Exchange Infrastructure BC-XI component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error...