Page 19 of 124 results (0.004 seconds)

CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0

CVE-2021-27633

https://notcve.org/view.php?id=CVE-2021-27633

SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCPIC() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified. SAP NetWeaver AS para ABAP (RFC Gateway), versiones - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT, 7.49, KRNL64UC - 8.04,7.22,7.22EXT, 7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49 , 7.53,7.73,7.77,7.81,7.82,7.83, permite a un atacante no autenticado sin conocimiento específico del sistema enviar un paquete especialmente diseñado a través de una red que desencadenará un error interno en el sistema debido a una comprobación inapropiada de entrada en el método ThCPIC() causando el bloqueo del sistema y hacer que no esté disponible. En este ataque, ningún dato del sistema puede ser visualizado o modificado • https://launchpad.support.sap.com/#/notes/3020209 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 • CWE-787: Out-of-bounds Write •

CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0

CVE-2021-27611

https://notcve.org/view.php?id=CVE-2021-27611

SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service. SAP NetWeaver AS ABAP, versiones - 700, 701, 702, 730, 731, permiten a un atacante muy privilegiado inyectar código malicioso al ejecutar un reporte ABAP cuando el atacante tiene acceso al sistema SAP local. El atacante puede entonces conseguir acceso a los datos, sobrescribirlos o ejecutar una denegación de servicio • https://launchpad.support.sap.com/#/notes/3046610 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2021-27603

https://notcve.org/view.php?id=CVE-2021-27603

An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system. Un módulo de función SPI_WAIT_MILLIS habilitado para RFC en SAP NetWeaver AS ABAP, versiones - 731, 740, 750, permite mantener un proceso de trabajo ocupado durante cualquier período de tiempo. Un atacante podría llamar a este módulo de funciones varias veces para bloquear todos los procesos de trabajo, conllevando a una Denegación de Servicio y afectaría la Disponibilidad del sistema SAP • https://launchpad.support.sap.com/#/notes/3028729 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649 •

CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0

CVE-2021-21446

https://notcve.org/view.php?id=CVE-2021-21446

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service. SAP NetWeaver AS ABAP, versiones 740, 750, 751, 752, 753, 754, 755, permite a un atacante no autenticado impedir que usuarios legítimos accedan a un servicio, ya sea bloqueando o inundando el servicio, esto presenta un alto impacto en la disponibilidad de el servicio • https://launchpad.support.sap.com/#/notes/3000306 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 •

CVSS: 7.6EPSS: 1%CPEs: 13EXPL: 2

CVE-2020-26832 – SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization

https://notcve.org/view.php?id=CVE-2020-26832

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable. SAP AS ABAP (SAP Landscape Transformation), versiones - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 y SAP S4 HANA (SAP Landscape Transformation), versiones - 101, 102, 103, 104, 105, permite a un usuario muy privilegiado ejecutar un módulo de función RFC al que debe estar restringido el acceso; sin embargo, debido a una falta de autorización, un atacante puede obtener acceso a información interna confidencial del sistema SAP vulnerable o hacer a sistemas SAP vulnerables no disponibles completamente The SAP application server ABAP and ABAP Platform are susceptible to code injection, SQL injection, and missing authorization vulnerabilities. Multiple SAP products are affected. • http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html http://seclists.org/fulldisclosure/2022/May/42 https://launchpad.support.sap.com/#/notes/2993132 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 • CWE-862: Missing Authorization •