[DSECRG-11-030] SAP NetWeaver JavaMailExamples - XSS

SAP NetWeaver JavaMailExamples has linked XSS vulnerability. Digital Security Research Group DSecRG Advisory Internal DSecRG-00135 Application: SAP NetWeaver Versions Affected: SAP NetWeaver JavaMailExamples Vendor URL: http://www.SAP.com Bugs: XSS Exploits: YES Reported: 11.05.2010 Vendor...

SAP NetWeaver BW Doc Cross Site Scripting

DSECRG-11-037 SAP BW Doc - Multiple XSS BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: XSS Reported: 14.03.2011 Vendor response: 16.03.2011 Date of Public Advisory: 11.11.20...

SAP NetWeaver Business Communication Broker - multiple XSS

Application: SAP NetWeaver Vendor URL: Bugs: Multiple XSS Risk: High Exploits: YES Reported: 09.12.2011 Vendor response: 10.12.2011 Date of Public Advisory: 20.01.2012 Reference: SAP Security Note 1585652 Description SAP NetWeaver Business Communication Broker has multiple linked XSS vulnerabilie...

SAP NetWeaver Exportability Check Service - unauthorized directory traversal

Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver J2EE Vendor URL: http://www.sap.com Bugs:Directory Traversal, File Read Exploits: YES Reported: 19.08.2011 Vendor response: 20.08.2011 Date of SAP Security Note Published: 08.01.2013 Date of Public Advisory: 28.01.2013 Reference: SA...

SAP NetWeaver Portal - Directory Traversal

Application: SAP NetWeaver Portal Versions Affected: SAP NetWeaver Portal Vendor URL: http://www.sap.com Bugs:Directory Traversal Exploits: YES Reported: 08.08.2011 Vendor response:10.08.2011 Date of Public Advisory:13.03.2012 Reference: SAP Security Note 1630293 Author:Dmitriy Chastuchin ERPScan...

SAP Netweaver - XML Entity Expansion DOS

Application: SAP NetWeaver Vendor URL: Bugs: DOS Risk: High Exploits: YES Reported: 08.04.2011 Vendor response: 10.04.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1594475 Author: Alexey Tyurin ERPScan Description SAP Netweaver – XML Entity Expansion It...

SAP Internet Sales - XSS

Application: SAP NetWeaver Vendor URL: Bugs: XSS Risk: High Exploits: YES Reported: 08.04.2011 Vendor response: 08.04.2011 Date of Public Advisory: 17.02.2012 Reference: SAP Security Note 1583300 Description SAP NetWeaver 7.0 Internet Sales crm.b2b has XSS vulnerability. Business Risk An attacker...

SAP NetWeaver PMI Agent Configuration - XML External Entity

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: XML External Entity Exploits: YES Reported: 07.12.2011 Vendor response: 08.12.2011 Date of Public Advisory: 22.10.2012 Reference: SAP Security Note 1721309 Author: Dmitry Chastukhin ERPScan Descriptio...

SAP NetWeaver Solution Manager - Missing Authorization Check & Information Disclosure

Application: SAP NetWeaver Solution Manager Versions Affected: SAP NetWeaver Solution Manager Vendor URL: http://www.sap.com Bugs: Missing Authorization Check & Information Disclosure Reported: 07.12.2011 Vendor response: 08.12.2011 Date of Public Advisory: 25.01.2014 Reference: SAP Security Note...

SAP Adapter Monitor - information disclosure

Application: SAP NetWeaver Vendor URL: Bugs: Information disclosure Risk: High Exploits: YES Reported: 06.12.2011 Vendor response: 06.12.2011 Date of Public Advisory: 17.12.2011 Reference: SAP Security Note 1445998 Description Information disclosure in com.sap.aii.mdt.amt.web.AMTPageProcessor...

SAP NetWeaver AdapterFramework - information disclosure

Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver J2EE Vendor URL: http://www.sap.com Bugs: Information Disclosure Exploits: YES Reported: 06.12.2011 Vendor response: 07.12.2011 Date of Public Advisory: 13.11.2012 Reference: SAP Security Note 1679897 Authors: Dmitry Chastukhin...

SAP Crystal Reports 2008 - Multiple XSS

Application: SAP Crystal Reports Vendor URL: Bugs: XSS Risk: Medium Exploits: YES Reported: 13.05.2011 Vendor response: 17.05.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1647871 Author: Dmitriy Chastuchin ERPScan Description XSS in MessagingSystem SAP...

SAP NetWeaver RFC WSDL - XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 6.40, 7.02 and maybe others Vendor URL: http://www.sap.com Bugs: XSS Exploits: YES Reported: 13.05.2011 Vendor response: 15.05.2011 Date of Public Advisory: 13.06.2012 Reference: SAP Security Note 1614834 Author: Alexey Tyurin ERPScan...

SAP Netweaver ABAP - XML External Entity

Application: SAP NetWeaver ABAP Vendor URL: Bugs: XXE, Unauthorized access Risk: High Exploits: YES Reported: 13.05.2011 Vendor response: 17.05.2011 Patched: 13.11.2011 Date of Public Advisory: 13.03.2012 Reference: SAP Security Note 1594475 Author: Alexey Tyurin ERPScan Description SAP Netweaver...

[DSECRG-11-014] SAP GUI (sapgui) - DLL hijacking

DSECRG-11-014 SAP GUI sapgui - DLL hijacking SAP Front End applications SAPGui.exe are vulnerable to DLL hijacking attacks. It makes possible to remote code execution Digital Security Research Group DSecRG Advisory DSecRG-11-014 Internal DSecRG-00183 Application: SAP GUI Versions Affected: 6.4 -...

[DSECRG-11-012] SAP NetWeaver Integration Directory - multiple XSS

DSECRG-11-012 SAP NetWeaver Integration Directory - multiple XSS SAP NetWeaver Integration Directory has multiple linked XSS vulnerabilities. Digital Security Research Group DSecRG Advisory DSecRG-11-012 Internal DSecRG-00159 Application: SAP NetWeaver XI Versions Affected: SAP NetWeaver XI Vendo...

SAP Application Administration - local file read

Application: SAP NetWeaver Vendor URL: Bugs: Local file read Risk: High Exploits: YES Reported: 14.03.2011 Vendor response: 15.03.2011 Date of Public Advisory: 17.02.2012 Reference: SAP Security Note 1585527 Description SAP NetWeaver 7.0 Application Administration com.sap.ipc.webapp.ipc has local...

Joomla! Component com_xcloner-backupandrestore - Remote Command Execution

!/usr/bin/python Joomla component comxcloner-backupandrestore remote code execution exploit Vendor: http://www.xcloner.com/ "Our true divinity is in our ability to create. And armed with the understanding of the symbiotic connections of life, while being guided by the emergent nature of reality,...

SAP Crystal Report Server 2008 Directory Traversal

Exploit for jsp platform in category web applications Application: SAP Crystal Report Server 2008 Versions Affected: SAP Crystal Report Server 2008 Vendor URL: http://sap.com Bugs: Directory Traversal File Read Exploits: YES Reported: 29.03.2010 Vendor response: 30.03.2010 Date of SAPNOTE...

[DSECRG-00142] SAP Crystal Reports 2008 - actionNavjsp_xss

XSS vulnerability found in SAP Crystal Report Server 2008 Application: SAP Crystal Report Server 2008 Versions Affected: SAP Crystal Report Server 2008 Vendor URL: http://sap.com Bugs: Linked XSS Vulnerability Exploits: YES Reported: 04.03.2010 Vendor response: 05.03.2010 Date of SAPNOTE Publishe...