Lucene search

K
SapNetweaver Application Server Abap

76 matches found

CVE
CVE
added 2021/04/13 7:15 p.m.44 views

CVE-2021-27603

An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Av...

6.5CVSS6.5AI score0.00514EPSS
CVE
CVE
added 2022/09/13 4:15 p.m.44 views

CVE-2022-35294

An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authen...

5.4CVSS5.4AI score0.00671EPSS
CVE
CVE
added 2020/11/10 5:15 p.m.43 views

CVE-2020-26818

SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which reveals sensitive system information that would otherwise be restricted to highly privileged users because of missing authorization, result...

8.8CVSS8.2AI score0.00251EPSS
CVE
CVE
added 2020/08/12 2:15 p.m.43 views

CVE-2020-6296

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.

8.8CVSS8.7AI score0.00516EPSS
CVE
CVE
added 2024/09/10 3:15 a.m.43 views

CVE-2024-44114

SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.

2.7CVSS3.9AI score0.00074EPSS
CVE
CVE
added 2020/06/10 1:15 p.m.42 views

CVE-2020-6275

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce th...

9.8CVSS9.3AI score0.00435EPSS
CVE
CVE
added 2021/11/10 4:15 p.m.42 views

CVE-2021-40504

A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions.

4.9CVSS5.2AI score0.00106EPSS
CVE
CVE
added 2021/12/14 4:15 p.m.42 views

CVE-2021-44231

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

9.8CVSS9.3AI score0.00626EPSS
CVE
CVE
added 2023/02/14 4:15 a.m.42 views

CVE-2023-23859

SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information.

6.1CVSS6.2AI score0.00443EPSS
CVE
CVE
added 2023/07/11 3:15 a.m.42 views

CVE-2023-35874

SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs...

7.4CVSS6.8AI score0.00102EPSS
CVE
CVE
added 2024/09/10 4:15 a.m.42 views

CVE-2024-41728

Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects contained in a package. This causes an impact on confidentiality, as this attacker would otherwise not have access to view these objects.

2.7CVSS3.6AI score0.00098EPSS
CVE
CVE
added 2020/06/10 1:15 p.m.41 views

CVE-2020-6270

SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user...

6.5CVSS6.4AI score0.00253EPSS
CVE
CVE
added 2020/07/14 1:15 p.m.41 views

CVE-2020-6280

SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure.

4CVSS4.1AI score0.00355EPSS
CVE
CVE
added 2021/06/09 2:15 p.m.41 views

CVE-2021-33664

SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

5.4CVSS5.3AI score0.00237EPSS
CVE
CVE
added 2021/10/12 3:15 p.m.41 views

CVE-2021-40499

Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

9.8CVSS9.4AI score0.00841EPSS
CVE
CVE
added 2020/11/10 5:15 p.m.39 views

CVE-2020-26819

SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that allows them to read and delete database logfiles because of Improper Access Control.

8.8CVSS8.4AI score0.00364EPSS
CVE
CVE
added 2024/08/13 5:15 a.m.39 views

CVE-2024-41734

Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability.

4.3CVSS4.6AI score0.00094EPSS
CVE
CVE
added 2020/12/09 5:15 p.m.38 views

CVE-2020-26835

SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability.

6.1CVSS5.9AI score0.00371EPSS
CVE
CVE
added 2020/08/12 2:15 p.m.38 views

CVE-2020-6310

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure.

4.3CVSS4.5AI score0.00398EPSS
CVE
CVE
added 2021/05/11 3:15 p.m.38 views

CVE-2021-27611

SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service.

8.2CVSS6.3AI score0.00111EPSS
CVE
CVE
added 2023/04/11 3:15 a.m.38 views

CVE-2023-27499

SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure...

6.1CVSS6AI score0.00416EPSS
CVE
CVE
added 2020/08/12 2:15 p.m.36 views

CVE-2020-6299

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value help, leading to Information Disclosure.

4.3CVSS4.6AI score0.00347EPSS
CVE
CVE
added 2021/06/09 2:15 p.m.36 views

CVE-2021-33665

SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

5.4CVSS5.3AI score0.00237EPSS
CVE
CVE
added 2024/01/09 2:15 a.m.35 views

CVE-2024-21738

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.

5.4CVSS5.2AI score0.00198EPSS
CVE
CVE
added 2023/04/11 3:15 a.m.34 views

CVE-2023-28763

SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the net...

6.5CVSS6.4AI score0.00229EPSS
CVE
CVE
added 2021/06/09 2:15 p.m.31 views

CVE-2021-33663

SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83,7.84, allows an unauthorized attacker to insert cleartext commands due to improper r...

5.8CVSS5.3AI score0.00189EPSS
Total number of security vulnerabilities76