CVE-2016-2387: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 ns or 2 interface parameter to ProxyServer/register, aka SAP Security Note 2220571...

Multiple Cross-Site Scripting Vulnerabilities in SAP NetWeaver

SAP NetWeaver is a service-oriented, integrated application platform. A cross-site scripting vulnerability exists in SAP NetWeaver, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user...

SAP NetWeaver Information Disclosure Vulnerability (CNVD-2016-00444)

SAP NetWeaver is a service-oriented, integrated application platform. A security vulnerability in SAP NetWeaverUser Management Engine allows remote attackers to exploit the vulnerability to decrypt data...

CVE-2016-1911

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

CVE-2016-1911

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

CVE-2016-1910

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1910

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

Code injection

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1911

CVE-2016-1911 concerns SAP NetWeaver 7.4 with multiple cross-site scripting (XSS) vulnerabilities. The affected components are the Runtime Workbench (RWB) and the Pmitest servlet in the Process Monitoring Infrastructure (PMI). The underlying issue is XSS that could allow remote attackers to injec...

CVE-2016-1910

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1910

CVE-2016-1910 affects SAP NetWeaver 7.4 UME (User Management Engine) and is described as a cryptographic issue enabling attackers to decrypt data via unspecified vectors (SAP Security Note 2191290). The connected materials indicate this is a crypto-issue vulnerability with publicly available PoCs...

CVE-2016-1911

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

PT-2016-4917

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.4 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to the Runtime...

PT-2016-4916

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.4 Description The issue in the User Management Engine UME of SAP NetWeaver allows attackers to decrypt unspecified data. Recommendations For SAP NetWeaver version 7.4, apply the fix as described in SAP Security Note...

CVE-2016-1910: Exposure of Sensitive Information to an Unauthorized Actor

The User Management Engine UME in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290...

CVE-2016-1911: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 Runtime Workbench RWB or 2 Pmitest servlet in the Process Monitoring Infrastructure PMI, aka SAP Security Notes 2206793 and 2234918...

SAP Hostcontrol remote DOS

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.0 – 7.5 Vendor URL: SAP Bug: DoS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 13.06.2017 Reference: SAP Security Note 2389181 Authors: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: D...

SAP AS Java XSS in Enterprise Portal

Application: SAP NetWeaver AS Java Vendor URL: SAP Bugs: XSS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 09.05.2017 Reference: SAP Security Note 2412897 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS Impact: Account hijacking Remotely...

SAP Netweaver Java deserialization of untrusted user value in metadatauploader

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7400.12.21.30308 Vendor URL: SAP Bugs: DoS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 14.03.2017 Reference: SAP Security Note 2399804 Author: Vahagn VardanyanERPScan & Mathieu Geli ERPScan VULNERABILITY...