[DSECRG-11-034] SAP NetWeaver J2EE MeSync – information disclose

DSECRG-11-034 SAP NetWeaver J2EE MeSync – information disclose Attacker can get information about mobile engine version and sometimes the name of the technical user. Application: SAP NetWeaver Versions Affected: SAP NetWeaver MI 2 Vendor URL: http://www.SAP.com Bugs: information disclosure...

[DSECRG-11-036] SAP NetWaver Virus Scan Interface - multiple XSS

DSECRG-11-036 SAP NetWaver Virus Scan Interface - multiple XSS SAP Netweaver Virus Scan Interface has linked XSS vulnerabilities. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 01.04.2010 Vendor response: 08.04.2010 Date of Public...

[DSECRG-11-038] SAP RSTXSCRP report - smb relay vulnerability

DSECRG-11-038 SAP RSTXSCRP report - smb relay vulnerability SAP RSTXSCRP Report has path traversal vulnerability which can lead to SMB relay attack and full control on system. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: Path traversal, SMBRelay...

[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose

DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...

[DSECRG-11-039] SAP NetWeaver TH_GREP module - Code injection vulnerability (NEW)

DSECRG-11-039 SAP NetWeaver THGREP module - Code injection vulnerability NEW THGREP report is vulnerable for command execution vulnerability which is working with previous patch note 1433101. Remote OS command execution is possible Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendo...

SAP NetWeaver BW Doc Cross Site Scripting

DSECRG-11-037 SAP BW Doc - Multiple XSS BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 14.03.2011 Vendor response: 16.03.2011 Date of Public Advisory: 11.11.20...

[DSECRG-11-032] SAP NetWeaver ipcpricing - information disclose (by ERPScan)

DSECRG-11-032 SAP NetWeaver ipcpricing - information disclose com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability Digital Security Research Group DSecRG Advisory DSECRG-11-032 Internal DSecRG-00197 Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL...

SAP NetWeaver Business Communication Broker - multiple XSS

Application: SAP NetWeaver Vendor URL: Bugs: Multiple XSS Risk: High Exploits: YES Reported: 09.12.2011 Vendor response: 10.12.2011 Date of Public Advisory: 20.01.2012 Reference: SAP Security Note 1585652 Description SAP NetWeaver Business Communication Broker has multiple linked XSS vulnerabilie...

SAP NetWeaver Exportability Check Service - unauthorized directory traversal

Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver J2EE Vendor URL: http://www.sap.com Bugs:Directory Traversal, File Read Exploits: YES Reported: 19.08.2011 Vendor response: 20.08.2011 Date of SAP Security Note Published: 08.01.2013 Date of Public Advisory: 28.01.2013 Reference: SA...

SAP NetWeaver Portal - Directory Traversal

Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal Vendor URL: http://www.sap.com Bugs:Directory Traversal Exploits: YES Reported: 08.08.2011 Vendor response:10.08.2011 Date of Public Advisory:13.03.2012 Reference: SAP Security Note 1630293 Author:Dmitriy Chastuchin ERPScan...

SAP NetWeaver Internet Sales-Multiple XSS - 2

Application: SAP NetWeaver Vendor URL: Bugs: XSS Risk: Medium Exploits: YES Reported: 08.04.2011 Vendor response: 10.04.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1584030 Author: Dmitriy Chastuchin ERPScan Description SAP NetWeaver Internet...

SAP NetWeaver SPML - XML External Entity

Application: SAP NetWeaver JAVA Versions Affected: 6.40/7.02 maybe others Vendor URL: http://www.sap.com Bugs: XML External Entity Exploits: YES Reported: 08.04.2011 Vendor response: 09.04.2011 Patched by SAP: 11.09.2012 Date of Public Advisory: 15.12.2012 Reference: SAP Security Note 1621534...

SAP Netweaver - XML Entity Expansion DOS

Application: SAP NetWeaver Vendor URL: Bugs: DOS Risk: High Exploits: YES Reported: 08.04.2011 Vendor response: 10.04.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1594475 Author: Alexey Tyurin ERPScan Description SAP Netweaver – XML Entity Expansion It...

SAP Internet Sales - XSS

Application: SAP NetWeaver Vendor URL: Bugs: XSS Risk: High Exploits: YES Reported: 08.04.2011 Vendor response: 08.04.2011 Date of Public Advisory: 17.02.2012 Reference: SAP Security Note 1583300 Description SAP NetWeaver 7.0 Internet Sales crm.b2b has XSS vulnerability. Business Risk An attacker...

On 4th August SAP systems will be hacked on internet in BlackHat USA 2011

On 4th August SAP systems will be hacked on internet in BlackHat USA 2011 On the 4th of august at the world largest technical security conference - BlackHat USA 2011, which will take place in Las Vegas, SAP security expert and CTO of ERPScan Alexander Polyakov will show how any malicious attacker...

SAP NetWeaver servlet DataCollector - Multiple XSS

Application: SAP NetWeaver DataCollector Versions Affected: SAP NetWeaver DataCollector Vendor URL: Bugs: XSS E xploits: YES Reported: 30.07.2011 Vendor response: 02.08.2011 Date of Public Advisory: 30.10.2013 Reference: SAP Security Note 1828801 CVSS: AV:N/AC:L/AU:S/C:C/I:N/A:N 6.8 Author: Dmitr...

SAP NetWeaver servlet JavaDumpService - Multiple XSS

Application: SAP NetWeaver JavaDumpService Versions Affected: SAP NetWeaver JavaDumpService Vendor URL: Bugs: XSS Exploits: YES Reported: 30.07.2011 Vendor response: 02.08.2011 Date of Public Advisory: 30.10.2013 Reference: SAP Security Note 1828801 CVSS: AV:N/AC:M/AU:N/C:N/I:P/A:N 4.3 Author:...

SAP NetWeaver Portal - Unauthorized access to OS

Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal Vendor URL: http://www.sap.com Bugs:Directory Traversal Exploits: YES Reported: 29.07.2011 Vendor response:01.08.2011 Date of Public Advisory:10.04.2012 Reference: SAP Security Note 1630293 Author:Alexey SintsovERPScan...

SAP NetWeaver J2EE MeSync – information disclose

Application: SAP NetWeaver Versions Affected: SAP NetWeaver MI 2 Vendor URL: http://www.sap.com Bugs:information disclosure Exploits: YES Reported: 29.07.2011 Vendor response:30.07.2011 Date of Public Advisory:11.11.2011 Author: Alexander Polyakov Description Attacker can get information about...

SAP Netweaver CCMS - XML External Entity

Application: SAP NetWeaver ABAP Versions Affected: SAP NetWeaver ABAP Vendor URL: http://www.sap.com Bugs: XML External Entity Exploits: YES Reported: 07.12.2011 Vendor response: 08.12.2011 Date of Public Advisory: 13.11.2012 Reference: SAP Security Note 1715040 Authors: Alexey Tyurin ERPScan...