Show filters
84 Total Results
Displaying 61-70 of 84
Sort by:
Attacker Value
Unknown
CVE-2018-2452
Disclosure Date: September 11, 2018 (last updated November 27, 2024)
The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability.
0
Attacker Value
Unknown
CVE-2017-14581
Disclosure Date: September 19, 2017 (last updated November 26, 2024)
The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181.
0
Attacker Value
Unknown
CVE-2017-12637
Disclosure Date: August 07, 2017 (last updated February 15, 2024)
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
0
Attacker Value
Unknown
CVE-2017-11457
Disclosure Date: July 25, 2017 (last updated November 26, 2024)
XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, aka SAP Security Note 2387249.
0
Attacker Value
Unknown
CVE-2017-11458
Disclosure Date: July 25, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783.
0
Attacker Value
Unknown
CVE-2017-8913
Disclosure Date: May 23, 2017 (last updated November 26, 2024)
The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873.
0
Attacker Value
Unknown
CVE-2017-7717
Disclosure Date: April 14, 2017 (last updated November 26, 2024)
SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2356504.
0
Attacker Value
Unknown
CVE-2016-10304
Disclosure Date: April 10, 2017 (last updated November 26, 2024)
The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788.
0
Attacker Value
Unknown
CVE-2016-9563
Disclosure Date: November 23, 2016 (last updated November 25, 2024)
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
0
Attacker Value
Unknown
CVE-2016-9562
Disclosure Date: November 23, 2016 (last updated November 25, 2024)
SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835.
0
