Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 444

Export CSV
CVE-2024-27898

Server-Side Request Forgery in SAP NetWeaver

SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-30744

Improper access control during application start-up in SAP AS NetWeaver JAVA.

In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication.  A subsequent call to one of these methods can read or change the state of existing services without any effect on availability.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server For Java
CVE-2023-32114

Denial of Service in SAP NetWeaver

SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-33984

Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)

SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-33985

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2024-34688

Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)

Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity but a high impact on the availability of the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2024-34685

[CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor

Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application but it has a low impact on its confidentiality and integrity.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Knowledge Management And Collaboration \(kmc-cm\)
CVE-2024-33001

Denial of service (DOS) in SAP NetWeaver and ABAP platform

SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap
CVE-2024-28164

Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)

SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2024-24743

XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)

SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2024-22124

Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager

Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-49581

SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap
CVE-2023-42480

Information Disclosure in NetWeaver AS Java Logon

The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2023-42477

Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)

SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Java
CVE-2023-41367

Missing Authentication check in SAP NetWeaver (Guided Procedures)

Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver
CVE-2023-41366

Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT, allows an unauthenticated attacker to access the unintended data due to the lack of restrictions applied which may lead to low impact in confidentiality and no impact on the integrity and availability of the application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap
CVE-2023-40624

Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)

SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap
CVE-2023-40309

Missing Authorization check in SAP CommonCryptoLib

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Commoncryptolib Content Server Extended Application Services And Runtime and 6 more
CVE-2023-40308

Memory Corruption vulnerability in SAP CommonCryptoLib

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Commoncryptolib Content Server Extended Application Services And Runtime and 6 more
CVE-2023-37492

Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793, SAP_BASIS 804, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read sensitive information which can be used in a subsequent serious attack.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap