CVE-2006-1039

CVE-2006-1039 affects the SAP Web Application Server (WebAS) Kernel prior to 7.0. The vulnerability allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information (and potentially other impacts) by exploiting a ";%20" sequence followed by ...

SAP Web Application Server crossite scripting

No description provided...

CVE-2005-3635

Multiple cross-site scripting XSS vulnerabilities in SAP Web Application Server WAS 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via 1 the sap-syscmd in sap-syscmd and 2 the BspApplication field in the SYSTEM PUBLIC test application...

CVE-2005-3636

Cross-site scripting XSS vulnerability in SAP Web Application Server WAS 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages...

CVE-2005-3633

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter...

CVE-2005-3635

Multiple cross-site scripting XSS vulnerabilities in SAP Web Application Server WAS 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via 1 the sap-syscmd in sap-syscmd and 2 the BspApplication field in the SYSTEM PUBLIC test application...

CVE-2005-3633

The CVE-2005-3633 entry describes an HTTP response splitting vulnerability in SAP Web Application Server (WAS) 6.10 through 7.00. The issue affects frameset.htm, allowing remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter. The vulnerability’s root cause is improper ha...

CVE-2005-3635

SAP Web Application Server (WAS) 6.10–7.00 has multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary web script or HTML via (1) sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application. The sources confirm...

CVE-2005-3634

SAP Web Application Server (WAS) 6.10–7.00 is affected by an open redirect in frameset.htm of the BSP runtime. A remote attacker can cause users to log out and be redirected to arbitrary sites by manipulating sap-sessioncmd (close) and sap-exiturl parameters. The vulnerability is tied to the BSP ...

CVE-2005-3636

The vulnerability CVE-2005-3636 is an XSS flaw in SAP Web Application Server (WAS) 6.10 that allows remote attackers to inject arbitrary web script or HTML through Error Pages. The NVD entry notes a MEDIUM severity (CVSS2: AV:N/AC:M/Au:N/C:N/I:P/A:N) with a partial integrity impact. No exploit de...

CVE-2005-3633

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter...

Multiple SAP Web Application Server vulnerabilities

Crossite scripting, request redirection, HTTP response splitting...

[Full-disclosure] CYBSEC - Security Advisory: Phishing Vector in SAP WAS

The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSECSecurityAdvisoryPhishingVectorinSAPWAS.pdf CYBSEC S.A. www.cybsec.com Advisory Name: Phishing Vector in SAP WAS Web Application Server Vulnerability Class: Phishing Vector / Improper Input...

SAP Web Application Server 6.x7.0 - Open Redirection

SAP Web Application Server 6.x7.0 - Open Redirection source: https://www.securityfocus.com/bid/15362/info SAP Web Application Server is reported prone to a remote URI redirection vulnerability. It is reported that an attacker can exploit this issue by supplying the URI of a malicious site through...

SAP Web Application Server 6.x7.0 - frameset.htm?sap-syscmd Cross-Site Scripting

SAP Web Application Server 6.x7.0 - frameset.htm?sap-syscmd Cross-Site Scripting source: https://www.securityfocus.com/bid/15361/info SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize...

SAP Web Application Server 6.x7.0 - Error Page Cross-Site Scripting

SAP Web Application Server 6.x7.0 - Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/15361/info SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied...

[Full-disclosure] CYBSEC - Security Advisory: Multiple XSS in SAP WAS

The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSECSecurityAdvisoryMultipleXSSinSAPWAS.pdf CYBSEC S.A. www.cybsec.com Advisory Name: Multiple XSS in SAP WAS Web Application Server Vulnerability Class: Cross-Site Scripting Release Date:...

SAP Web Application Server 6.x7.0 - Input Validation

SAP Web Application Server 6.x7.0 - Input Validation source: https://www.securityfocus.com/bid/18006/info SAP Web Application Server is prone to an input-validation vulnerability that results in HTTP response-splitting attacks. This issue is due to a failure in the application to properly sanitiz...

SAP Web Application Server 6.x/7.0 - Input Validation

source: https://www.securityfocus.com/bid/18006/info SAP Web Application Server is prone to an input-validation vulnerability that results in HTTP response-splitting attacks. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit...

SAP Web Application Server 6.x/7.0 - Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/15361/info SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script...