SAP Portal webdynpro - information disclosure

Application: SAP NetWeaver J2EE 7.31 Vendor URL: SAP Bug: Information Disclosure Reported: 20.04.2013 Vendor response: 21.04.2013 Date of Public Advisory: 14.06.2016 Reference: SAP Security Note 2197262 Author: Alexander Polyakov VULNERABILITY INFORMATION Class: Information disclosure Impact:...

SAP NetWeaver Portal 'ConfigServlet' RCE Vulnerability (1503579, 1616259) - Active Check

SAP NetWeaver Portal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

This module abuses the SAP NetWeaver SXPGCALLSYSTEM function, on the SAP SOAP RFC Service, to execute remote commands. This module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64-bit and Linux 64-bit...

SAP NetWeaver CA-CL SMB中继任意文件泄露漏洞

BUGTRAQ ID: 58612 SAP NetWeaver是下一代基于服务的平台，它将作为未来所有SAP应用程序的基础。 SAP NetWeaver 7.30及其他版本在Classification CA-CL内存在不明细节错误，通过SMB中继攻击SMB Relay attack，攻击者可利用此漏洞获取SAP服务器文件系统上的任意文件。 0 SAP NetWeaver 7.3 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sap.com/platform/netweaver/index.epx...

PT-2013-23: Sensitive Information Disclosure in SAP NetWeaver

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in SAP NetWeaver. Thus, obtaining access to the SAP server access to the table RSECTAB is required, an attacker can retrieve passwords to access other SAP systems, for which RFC...

PT-2013-24: Concealing User Authority in SAP NetWeaver

The specialists of the Positive Research center have detected "Concealing User Authority" vulnerability in SAP NetWeaver. No matter how much authority the user '............' has, it is not reflected in report RSUSR002. How to fix Update your software up to the latest version Advisory status...

SAP NetWeaver AdIExecBlkConv Message Server Buffer Overflow (CVE-2013-1593)

A code execution vulnerability exists in SAP NetWeaver Message Server. The vulnerability is due to a buffer overflow in the function AdIExecBlkConv while handling a request message. A remote attacker could trigger this flaw by sending a specially crafted message to a vulnerable server...

SAP NetWeaver Message Server Memory Corruption (CVE-2013-1592)

A code execution vulnerability has been reported in SAP NetWeaver Message Server. The vulnerability is due to an array index error in the function MsJ2EEAddStatistics. A remote attacker can exploit this vulnerability by sending a specially crafted message to a vulnerable server...

SAP Netweaver Message Server multiple security vulnerabilities

Code execution, DoS...

CORE-2012-1128 - SAP Netweaver Message Server Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. Advisory Information Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date...

SAP NetWeaver Message Server - Multiple Vulnerabilities

SAP NetWeaver Message Server - Multiple Vulnerabilities 1. Advisory Information Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date...

SAP NetWeaver Message Server - Multiple Vulnerabilities

Advisory Information Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release...

SAP Netweaver Message Server Buffer Overflow Vulnerability

Core Security Technologies Advisory - Multiple vulnerabilities have been found in SAP Netweaver that could allow an unauthenticated remote attacker to execute arbitrary code and lead to denial of service conditions. The vulnerabilities are triggered sending specially crafted SAP Message Server...

SAP Netweaver Message Server Buffer Overflow

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. Advisory Information Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date...

SAP Netweaver Message Server Multiple Vulnerabilities

1. Advisory Information Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release 2. Vulnerability Information Class: Improper...

CVE-2011-5263

Cross-site scripting XSS vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server parameter...

CVE-2011-5260

Cross-site scripting XSS vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2011-5260

CVE-2011-5260 is a Cross-site Scripting (XSS) vulnerability affecting SAP NetWeaver’s SAP/BW/DOC/METADATA component. The issue allows remote attackers to inject arbitrary web script or HTML via the page parameter, as documented in the NVD entry and mirrored by related records. Impact is limited t...