CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27268 – Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
https://notcve.org/view.php?id=CVE-2023-27268
14 Mar 2023 — SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability., resulting in escalation of privileges. • https://launchpad.support.sap.com/#/notes/3288480 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-26460 – Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)
https://notcve.org/view.php?id=CVE-2023-26460
14 Mar 2023 — Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity • https://launchpad.support.sap.com/#/notes/3288096 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-24526 – Improper Access Control in SAP NetWeaver AS Java (Classload Service)
https://notcve.org/view.php?id=CVE-2023-24526
14 Mar 2023 — SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data. • https://launchpad.support.sap.com/#/notes/3288394 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23857 – Improper Access Control in SAP NetWeaver AS for Java
https://notcve.org/view.php?id=CVE-2023-23857
14 Mar 2023 — Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and services across systems. On a successful exploitation, the attacker can read and modify some sensitive information but can also be used to lock up any element or operation of the system making that it unresponsive or unavailab... • https://launchpad.support.sap.com/#/notes/3252433 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0017 – Improper access control in SAP NetWeaver AS for Java
https://notcve.org/view.php?id=CVE-2023-0017
10 Jan 2023 — An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable. • https://launchpad.support.sap.com/#/notes/3268093 • CWE-284: Improper Access Control •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41262
https://notcve.org/view.php?id=CVE-2022-41262
12 Dec 2022 — Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into a web request header. On successful exploitation, an attacker can view or modify information causing a limited impact on the confidentiality and integrity of the application. Debido a una validación de entrada insuficiente, SAP NetWeaver AS Java (HTTP Provider Service), versión 7.50, permite a un atacante no autenticado inyectar un script en un encabe... • https://launchpad.support.sap.com/#/notes/3262544 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27669
https://notcve.org/view.php?id=CVE-2022-27669
12 Apr 2022 — An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an escalation of privileges. Un usuario no autenticado puede usar funciones del Servicio de Archivo de Datos XML de SAP NetWeaver Application Server for Java - versión 7.50, cuyo acceso debería estar restringido. Esto puede resultar en una escalada de privilegios • https://launchpad.support.sap.com/#/notes/3152442 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26103
https://notcve.org/view.php?id=CVE-2022-26103
08 Mar 2022 — Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to information gathering for further exploits and attacks. Bajo determinadas condiciones, SAP NetWeaver (Real Time Messaging Framework) - versión 7.50, permite a un atacante acceder a información que podría conllevar a una recopilación de información para otras explotaciones y ataques • https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-22533
https://notcve.org/view.php?id=CVE-2022-22533
09 Feb 2022 — Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could submit multiple HTTP server requests resulting in errors, such that it consumes the memory buffer. This could result in system shutdown rendering the system unavailable. Debido a un manejo inapropiado de errores en SAP NetWeaver Application Server Java - versiones KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EX... • https://launchpad.support.sap.com/#/notes/3123427 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-22532
https://notcve.org/view.php?id=CVE-2022-22532
09 Feb 2022 — In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session. En SAP NetWeaver Application Server Java - versiones KRNL64NUC 7.22, 7.22EXT, ... • https://launchpad.support.sap.com/#/notes/3123427 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •