CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-0305
https://notcve.org/view.php?id=CVE-2019-0305
12 Jun 2019 — Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data. Las páginas de servidor Java (JSP) proporcionadas por la integración de procesos de SAP NetWeaver (SAP_XIESR y SAP_XITO... • https://launchpad.support.sap.com/#/notes/2755502 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-0283
https://notcve.org/view.php?id=CVE-2019-0283
10 Apr 2019 — SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document. SAP NetWeaver Process Integration (Adapter Engine), ejecutado en las versiones 7.10 hasta 7.11, ... • https://launchpad.support.sap.com/#/notes/2747683 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-0282
https://notcve.org/view.php?id=CVE-2019-0282
10 Apr 2019 — Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker. Varias páginas web en SAP NetWeaver Process Integration (Runtime Workbench), corregidas en las versiones 7.10 hasta 7.11, 7.30, 7.31, 7.40, 7.50; puede ser accedida sin la autenticación del usuario, lo q... • https://launchpad.support.sap.com/#/notes/2742758 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-0278
https://notcve.org/view.php?id=CVE-2019-0278
10 Apr 2019 — Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure. Bajo ciertas condiciones, el Servlet de monitoreo de NetWeaver Process Integration (Sistema de Mensajería), corregido en las versiones 7.10 hasta 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite que un atacante vea los nombres de l... • https://launchpad.support.sap.com/#/notes/2741201 •