CVE-2005-3634

SAP Web Application Server (WAS) 6.10–7.00 is affected by an open redirect in frameset.htm of the BSP runtime. A remote attacker can cause users to log out and be redirected to arbitrary sites by manipulating sap-sessioncmd (close) and sap-exiturl parameters. The vulnerability is tied to the BSP ...

CVE-2006-1039

CVE-2006-1039 affects the SAP Web Application Server (WebAS) Kernel prior to 7.0. The vulnerability allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information (and potentially other impacts) by exploiting a ";%20" sequence followed by ...

CVE-2006-6010

CVE-2006-6010 affects SAP systems exposing the RFC_SYSTEM_INFO SOAP service (/sap/bc/soap/rfc) which can disclose sensitive information such as operating system and SAP version. The vulnerability centers on the RFC_SYSTEM_INFO function, enabling information gathering through the SAP RFC Library e...

CVE-2006-5784

CVE-2006-5784 affects SAP Web Application Server 6.40 (before patch 136) and 7.00 (before patch 66), specifically enserver.exe. The vulnerability allows remote attackers to read arbitrary files by sending crafted data to a TCP port in the 3200+SYSNR range, demonstrated via port 3201. Additionally...

CVE-2007-3615

SAP NetWeaver Application Server’s Internet Communication Manager (ICM/ICMAN.exe) in 6.x–7.x (Windows possibly) is vulnerable to a denial-of-service via a long URI containing sap-isc-key, related to web cache configuration. The connected documents do not provide additional technical details, expl...

CVE-2008-2421

CVE-2008-2421 concerns a Cross-site Scripting (XSS) vulnerability in the Web GUI of SAP Web Application Server (WAS) 7.0, affecting Web Dynpro for ABAP (WD4A/WDA) and Web Dynpro for BSP. The issue allows remote attackers to inject arbitrary web script or HTML via PATH_INFO to the default URI unde...

CVE-2005-3633

The CVE-2005-3633 entry describes an HTTP response splitting vulnerability in SAP Web Application Server (WAS) 6.10 through 7.00. The issue affects frameset.htm, allowing remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter. The vulnerability’s root cause is improper ha...

CVE-2006-5785

SAP Web Application Server is affected by CVE-2006-5785. The issue allows remote denial of service (enserver.exe crash) on UDP port 64999 via a 0x72F2 sequence for SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66. The vulnerability is confirmed in the NVD entry for CVE-20...

CVE-2005-3635

SAP Web Application Server (WAS) 6.10–7.00 has multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary web script or HTML via (1) sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application. The sources confirm...

CVE-2006-6011

CVE-2006-6011 relates to an unspecified vulnerability in SAP Web Application Server that can be exploited remotely to cause a denial of service (enserver.exe crash) via a 0x72F2 UDP sequence on port 64999. Affected: SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66. Remedi...

CVE-2005-3636

The vulnerability CVE-2005-3636 is an XSS flaw in SAP Web Application Server (WAS) 6.10 that allows remote attackers to inject arbitrary web script or HTML through Error Pages. The NVD entry notes a MEDIUM severity (CVSS2: AV:N/AC:M/Au:N/C:N/I:P/A:N) with a partial integrity impact. No exploit de...