[DSECRG-11-031] SAP RFC EPS_DELETE_FILE - Authorisation bypass, smbrelay

DSECRG-11-031 SAP RFC EPSDELETEFILE - Authorisation bypass, smbrelay Security vulnerability was founded in sap EPSDELETEFILE RFC function allows attacker to delete files remotely or steal hashes of SAP server account in windows environment using SMBRelay attack. Digital Security Research Group...

SAP NetWeaver BW Doc Cross Site Scripting

DSECRG-11-037 SAP BW Doc - Multiple XSS BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 14.03.2011 Vendor response: 16.03.2011 Date of Public Advisory: 11.11.20...

SAP NetWeaver Business Communication Broker - multiple XSS

Application: SAP NetWeaver Vendor URL: Bugs: Multiple XSS Risk: High Exploits: YES Reported: 09.12.2011 Vendor response: 10.12.2011 Date of Public Advisory: 20.01.2012 Reference: SAP Security Note 1585652 Description SAP NetWeaver Business Communication Broker has multiple linked XSS vulnerabilie...

SAP NetWeaver Portal - Directory Traversal

Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal Vendor URL: http://www.sap.com Bugs:Directory Traversal Exploits: YES Reported: 08.08.2011 Vendor response:10.08.2011 Date of Public Advisory:13.03.2012 Reference: SAP Security Note 1630293 Author:Dmitriy Chastuchin ERPScan...

SAP Netweaver - XML Entity Expansion DOS

Application: SAP NetWeaver Vendor URL: Bugs: DOS Risk: High Exploits: YES Reported: 08.04.2011 Vendor response: 10.04.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1594475 Author: Alexey Tyurin ERPScan Description SAP Netweaver – XML Entity Expansion It...

SAP NetWeaver PMI Agent Configuration - XML External Entity

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: XML External Entity Exploits: YES Reported: 07.12.2011 Vendor response: 08.12.2011 Date of Public Advisory: 22.10.2012 Reference: SAP Security Note 1721309 Author: Dmitry Chastukhin ERPScan Descriptio...

SAP Adapter Monitor - information disclosure

Application: SAP NetWeaver Vendor URL: Bugs: Information disclosure Risk: High Exploits: YES Reported: 06.12.2011 Vendor response: 06.12.2011 Date of Public Advisory: 17.12.2011 Reference: SAP Security Note 1445998 Description Information disclosure in com.sap.aii.mdt.amt.web.AMTPageProcessor...

SAP Crystal Reports 2008 - Multiple XSS

Application: SAP Crystal Reports Vendor URL: Bugs: XSS Risk: Medium Exploits: YES Reported: 13.05.2011 Vendor response: 17.05.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1647871 Author: Dmitriy Chastuchin ERPScan Description XSS in MessagingSystem SAP...

SAP NetWeaver RFC WSDL - XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 6.40, 7.02 and maybe others Vendor URL: http://www.sap.com Bugs: XSS Exploits: YES Reported: 13.05.2011 Vendor response: 15.05.2011 Date of Public Advisory: 13.06.2012 Reference: SAP Security Note 1614834 Author: Alexey Tyurin ERPScan...

[DSECRG-11-011] SAP Crystal Reports 2008 - Multiple XSS

DSECRG-11-011 SAP Crystal Reports 2008 - Multiple XSS SAP Crystal Report Server 2008 - multiple cross-site scripting vulnerabilities. SAP Crystal Report Server 2008 - Multiple cross-site scripting vulnerabilities. DSecRG-11-011 Internal DSECRG-00147 Multiple XSS vulnerabilities found in the modul...

SAP Application Administration - local file read

Application: SAP NetWeaver Vendor URL: Bugs: Local file read Risk: High Exploits: YES Reported: 14.03.2011 Vendor response: 15.03.2011 Date of Public Advisory: 17.02.2012 Reference: SAP Security Note 1585527 Description SAP NetWeaver 7.0 Application Administration com.sap.ipc.webapp.ipc has local...

SAP NetWeaver SPML - XML CSRF user creation

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Command execution Exploits: YES Reported: 14.03.2011 Vendor response:16.03.2011 Date of Public Advisory:11.11.2011 CVSS: 7.3 Author: Alexandr Polyakov Description Attacker can create a new user in J2EE...

R7-0037: SAP BusinessObjects Axis2 Default Admin Password

R7-0037: SAP BusinessObjects Axis2 Default Admin Password October 13th, 2010 Description: The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone with access to the Axis2 port...

Rapid7 Security Advisory 37

R7-0037: SAP BusinessObjects Axis2 Default Admin Password October 13th, 2010 Description: The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone with access to the Axis2 port...

SAP BusinessObjects Axis2 Default Admin Password

Overview The Axis2 component of SAP BusinessObjects contains a default administrator account and password. Description The SAP BusinessObjects product contains a module dswsbobje.war which deploys Axis2 with an administrator account which is configured with a static password. As a result, anyone...

[DSECRG-09-068] SAP NetWaver SLD - multiple XSS

Digital Security Research Group DSecRG Advisory DSecRG-09-068 Application: SAP NetWeaver SLD Versions Affected: 6.4 - 7.02 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 14.12.2009 Vendor response: 15.12.2009 last response: 06.05.2010 Date of Public Advisory: 13.07.2010 CVE-number:...

IBM Bladecenter Management - Multiple Web Application Vulnerabilities

DSECRG-09-054 IBM Bladecenter Management - Multiple vulnerabilities The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS Digital Security Research Group DSecRG Advisory DSECRG-09-054 Application: IBM BladeCenter Managemet...

SAP NetWeaver Workflow Modeler - Multiple XSS

Application: SAP NetWeaver Workflow Modeler Versions Affected: SAP NetWeaver NW2004s SP6 Workflow Modeler Vendor URL: http://www.sap.com Bugs: XSS Exploits: YES Reported: 06.08.2010 Vendor response: 07.08.2010 Date of Public Advisory: 12.02.2014 Reference: SAP Security Note 1860923 Author:...

SAP NetWeaver Application Server (UDDI client) XSS Vulnerability

Application: SAP NetWeaver Application Server Java Versions Affected: Version 7.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 18.03.2009 Vendor response: 19.03.2009 Date of Public Advisory: 11.08.2009 Reference: SAP Security Note 1322098 Author: Alexandr Polyakov Description SAP NetWeaver...