EUVD-2001-0363

Malware in sbrugna...

EUVD-2003-1025

Malware in sbrugna...

EUVD-2002-1559

Malware in sbrugna...

EUVD-2018-14291

Malware in sbrugna...

EUVD-2002-1558

Malware in sbrugna...

EUVD-2019-1084

Malware in sbrugna...

CVE-2019-0311

Automotive Dealer Portal in SAP R/3 Enterprise Application versions: 600, 602, 603, 604, 605, 606, 616, 617 does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious...

Cross site scripting

Automotive Dealer Portal in SAP R/3 Enterprise Application versions: 600, 602, 603, 604, 605, 606, 616, 617 does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious...

CVE-2019-0311

Automotive Dealer Portal in SAP R/3 Enterprise Application versions: 600, 602, 603, 604, 605, 606, 616, 617 does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious...

CVE-2019-0311: Improper Neutralization of Input During Web Page Generation

Automotive Dealer Portal in SAP R/3 Enterprise Application versions: 600, 602, 603, 604, 605, 606, 616, 617 does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious...

PT-2019-11227

Name of the Vulnerable Software and Affected Versions: SAP R/3 Enterprise Application Automotive Dealer Portal versions 600 through 617 Description: The issue arises from insufficient encoding of user-controlled inputs, allowing an attacker to send unwanted scripts to the victim's browser and...

CVE-2018-2436

Executing transaction WRCK in SAP R/3 Enterprise Retail EHP6 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2018-2436: Missing Authorization

Executing transaction WRCK in SAP R/3 Enterprise Retail EHP6 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

PT-2018-15560

Name of the Vulnerable Software and Affected Versions SAP R/3 Enterprise Retail EHP6 version not specified Description The issue arises from the execution of transaction WRCK in SAP R/3 Enterprise Retail EHP6, where necessary authorization checks for an authenticated user are not performed, leadi...

Cain & Abel v4.9.43 Released

Cain & Abel v4.9.43 Released Cain & Abel is a password recovery tool for Microsoft operating systems.It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using dictionary and brute force attacks, decoding scrambled passwords, revealing passwor...

Cain & Abel v4.9.43 Released

Cain & Abel v4.9.43 Released Cain & Abel is a password recovery tool for Microsoft operating systems.It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using dictionary and brute force attacks, decoding scrambled passwords, revealing passwor...

CYBSEC Release: SAP Security - Paper & Tool release

I am proud to announce the release of a White-paper and an open-source tool, both addressing security of SAP R/3 systems. The paper describes vulnerabilities discovered in the SAP RFC interface implementation and library, as well as some attacks that can be performed over SAP systems. The tool,...

SAP Internet Graphics Server远程缓冲区溢出漏洞

SAP Internet Graphics Server是SAP R/3企业环境的一个组件，可提供图形服务。 SAP Internet Graphics Server不正确处理用户提交的HTTP请求，远程攻击者可以利用漏洞进行缓冲区溢出攻击，可能以进程权限执行任意指令。 目前没有详细漏洞细节提供，成功利用漏洞可导致在UNIX系统下获得SAP系统管理员特权，而在windows下可导致获得SYSTEM权限。 SAP Internet Graphics Server 6.40 Patch 11 SAP Internet Graphics Server 6.40 SAP Internet...

CVE-2005-4815: Undefined Security Weakness

SAP 6.4 before 6.40 patch 4, 6.2 before 6.20 patch 1364, 4.6 before 4.6D patch 1767, 45 before 45B patch 913, 40 before 40B patch 1008, and 31 before 31I patch 735 do not properly restrict process execution by lnaxdm/sapsys, which allows remote attackers to execute arbitrary code via a certain UD...

r3mote_unix_UDPexec.pl.txt

!/usr/bin/perl -w use IO::Socket; Unix version of the FX SAP R/3 gwrd vuln. We partially control a call to excve made by lnaxdm/sapsys Easily exploitable with local access Could be done remotely under some conditions 2003, FX of Phenoelit Win32 original code 2005, Nicob Unix version $|=1; die "Gi...