5582 matches found
CVE-2016-3976: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971...
CVE-2016-3973: Exposure of Sensitive Information to an Unauthorized Actor
The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...
The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to gain access to protected information
The vulnerability of the Universal Worklist Configuration component of the SAP NetWeaver software integration platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a...
The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to read arbitrary files.
The vulnerability of the Manufacturing Integration and Intelligence xMII component of the SAP NetWeaver software integration platform is related to deficiencies in name-based path restrictions. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...
The vulnerability of the SAP NetWeaver software integration platform allows a hacker to inject any Web or HTML code.
The vulnerability of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...
PT-2016-3362 · Sap · Sap Netweaver As Java
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA version 7.5 Description: The issue is related to an XML External Entity XXE vulnerability in the BC-BMT-BPM-DSK component of SAP NetWeaver AS JAVA. This vulnerability allows remote authenticated users to conduct XXE...
The vulnerability of the SAP NetWeaver software integration platform allows a hacker to execute arbitrary SQL commands.
The vulnerability of the UDDI server component of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...
SAP NetWeaver J2EE Engine UDDI Server SQL Injection Vulnerability
SAP NetWeaver J2EE Engine is the German SAP SAP company's a service-oriented integrated application platform J2EE engine. A SQL injection vulnerability exists in the UDDI server of SAP NetWeaver J2EE Engine version 7.40. A remote attacker could exploit this vulnerability to execute arbitrary SQL...
SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2016-01150)
SAP NetWeaver is SAP SAP company's set of service-oriented integrated application platform. A cross-site scripting vulnerability exists in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver version 7.4. A remote attacker can exploit this vulnerability to inject arbitrary web script or HT...
SAP NetWeaver Manufacturing Integration and Intelligence Catalog Traversal Vulnerability
SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications.Manufacturing Integration and Intelligence also known as MII, formerly known as xMII is one of the core...
SAP NetWeaver Information Disclosure Vulnerability (CNVD-2016-01148)
SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in the Universal Worklist Configuration of SAP NetWeaver version 7.4. A remote...
CVE-2016-2388
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846...
CVE-2016-2387
Multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 ns or 2 interface parameter to ProxyServer/register, aka SAP Security Note 2220571...
CVE-2016-2387
Multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 ns or 2 interface parameter to ProxyServer/register, aka SAP Security Note 2220571...
CVE-2016-2386
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 ns or 2 interface parameter to ProxyServer/register, aka SAP Security Note 2220571...
Design/Logic Flaw
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846...
Sql injection
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079...
CVE-2016-2386
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079...
