CVE-2014-3129

CVE-2014-3129 relates to SAP NetWeaver’s Software Lifecycle Manager (SLM) Java Server Pages, where the JSP component handles a crafted request that can lead to information disclosure. Affected product area is SAP Solution Manager 7.1. The description in the connected sources confirms an informati...

CVE-2014-3130

Technical details (affected product/version, root cause, exploit information) are not provided in the supplied documents for CVE-2014-3130; monitor for updates.

CVE-2014-3130

The ABAP Help documentation and translation tools BC-DOC-HLP in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

CVE-2013-7364

SAP NetWeaver’s J2EE Engine contains an unspecified J2EE core service that does not properly restrict access. This allows remote attackers to read and write to arbitrary files via unknown vectors. Affected component: J2EE Engine (SAP NetWeaver). Root cause: inadequate access restrictions in a cor...

CVE-2013-7364

An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors...

PT-2014-09: Sensitive Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in SAP NetWeaver. An attacker can read any tables from SAP Central User Administration SAP CUA via accessing the system affiliated with SAP CUA. How to fix Update your software up to the...

CVE-2014-1960

The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-1964

Cross-site scripting XSS vulnerability in the Integration Repository in the SAP Exchange Infrastructure BC-XI component in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to the ESR application and a DIR error...

CVE-2014-1961

Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors...

CVE-2014-1963

Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors...

CVE-2014-1965

Cross-site scripting XSS vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure BC-XI component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP...

Design/Logic Flaw

Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors...

Information disclosure

The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors...

Code injection

Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors...

CVE-2014-1960

The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-1964

CVE-2014-1964 is an XSS vulnerability in the SAP NetWeaver Integration Repository (BC-XI) component of SAP Exchange Infrastructure. The issue affects the Integration Repository via the ESR application and a DIR error, enabling remote attackers to inject arbitrary web script or HTML. The NVD notes...

CVE-2014-1965

CVE-2014-1965 is an XSS vulnerability in the ISpeakAdapter of SAP Exchange Infrastructure (BC-XI) Integration Repository. Affected: SAP NetWeaver components 3.0, 7.00–7.02, and 7.10–7.11. Description: remote attackers could inject arbitrary web script/HTML via PIP vectors. Impact: potential brows...

CVE-2014-1963

Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors...

CVE-2014-1961

Technical details (affected software/versions, exploit info) are not provided in the supplied documents. Monitor for updates regarding CVE-2014-1961 from SAP NetWeaver's Portal WebDynPro vulnerability.