CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-21491
https://notcve.org/view.php?id=CVE-2021-21491
SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. SAP Netweaver Application Server Java (Aplicaciones basadas en WebDynpro Java) versiones 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permiten a un atacante redireccionar a usuarios a un sitio malicioso debido a vulnerabilidades de Reverse Tabnabbing • https://launchpad.support.sap.com/#/notes/2976947 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2020-26816
https://notcve.org/view.php?id=CVE-2020-26816
SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access to the SAP NetWeaver AS Java to decode the keys because of missing encryption and get some application data and client credentials of adjacent systems. This highly impacts Confidentiality as information disclosed could contain client credentials of adjacent systems. SAP AS JAVA (Key Storage Service), versiones - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, posee el material de claves que es almacenado en el servicio SAP NetWeaver AS Java Key Storage almacenado en la base de datos en el formato codificado DER. y no está cifrado. Esto permite a un atacante que tiene acceso de administrador a SAP NetWeaver AS Java decodificar las claves debido a la falta de cifrado y obtener algunos datos de la aplicación y las credenciales de cliente de los sistemas adyacentes. • https://launchpad.support.sap.com/#/notes/2971163 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6365
https://notcve.org/view.php?id=CVE-2020-6365
SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse tabnabbing URL validation. The attacker could execute phishing attacks to steal credentials of the victim or to redirect users to untrusted web pages containing malware or similar malicious exploits. SAP NetWeaver AS Java, versiones - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, la página de inicio permite a un atacante remoto no autenticado redireccionar a usuarios hacia un sitio malicioso debido a una comprobación insuficiente de URL de tabnabbing inverso. El atacante podría ejecutar ataques de phishing para robar las credenciales de la víctima o para redireccionar a los usuarios hacia páginas web no confiables que contienen malware o explotaciones maliciosos similares • https://launchpad.support.sap.com/#/notes/2969828 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6319
https://notcve.org/view.php?id=CVE-2020-6319
SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal authentication information of the user, such as data relating to his or her current session and limitedly impact confidentiality and integrity of the application, leading to Reflected Cross Site Scripting. SAP NetWeaver Application Server Java, versiones - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 y 7.50, permite a un atacante no autenticado incluir bloques de JavaScript en cualquier página web o URL con diferentes símbolos que de otro modo no están permitidos. En una explotación con éxito, un atacante puede robar información de autenticación del usuario, tal y como datos relacionados con su sesión actual e impactar de manera limitada la confidencialidad e integridad de la aplicación, conllevando a una vulnerabilidad de tipo Cross Site Scripting Reflejado • https://launchpad.support.sap.com/#/notes/2956398 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6309
https://notcve.org/view.php?id=CVE-2020-6309
SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service. SAP NetWeaver AS JAVA, versiones - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), no lleva a cabo ninguna comprobación de autenticación para un servicio web permitiendo al atacante enviar varias cargas útiles y conllevando a una denegación total del servicio • https://launchpad.support.sap.com/#/notes/2941315 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 • CWE-306: Missing Authentication for Critical Function •