CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11458
https://notcve.org/view.php?id=CVE-2017-11458
Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the sessionID parameter, aka SAP Security Note 2406783. La vulnerabilidad de tipo cross-site-scripting (XSS) en el servlet ctcprotocol/Protocol en SAP NetWeaver AS JAVA versión 7.3 permite a los atacantes remotos inyectar scripts web arbitrarios o HTML por medio del parámetro sessionID, también se conoce como Nota de Seguridad de SAP 2406783. • http://www.securityfocus.com/bid/97566 https://erpscan.io/advisories/erpscan-17-017-sap-netweaver-java-7-3-java-xss-ctcprotocolprotocol-servlet • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2015-2815
https://notcve.org/view.php?id=CVE-2015-2815
Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2063369. Desbordamiento de buffer en la función C_SAPGPARAM en NetWeaver Dispatcher en SAP KERNEL 7.00 (7000.52.12.34966) y 7.40 (7400.12.21.30308) permite a usuarios remotos autenticados causar una denegación de servicio o posiblemente ejecutar código arbitrario a través de vectores no especificados, también conocido como la nota de seguridad de SAP 2063369. • http://packetstormsecurity.com/files/132353/SAP-NetWeaver-Dispatcher-Buffer-Overflow.html http://seclists.org/fulldisclosure/2015/Jun/61 http://www.securityfocus.com/archive/1/535825/100/800/threaded http://www.securityfocus.com/bid/73897 https://erpscan.io/advisories/erpscan-15-003-sapkernel-c_sapgparam-rce-dos • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 3%CPEs: 2EXPL: 1CVE-2014-8591
https://notcve.org/view.php?id=CVE-2014-8591
Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via unknown vectors. Vulnerabilidad no especificada en SAP Internet Communication Manager (ICM), utilizado en SAP NetWeaver 7.02 y 7.3, permite a atacantes remotos causar una denegación de servicio (terminación de proceso) a través de vectores desconocidos. • http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition http://www.securityfocus.com/bid/71030 https://erpscan.io/advisories/erpscan-14-016-sap-netweaver-httpd-partial-http-post-requests-dos https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014 https://exchange.xforce.ibmcloud.com/vulnerabilities/98582 https://service.sap.com/sap/support/notes/1966655 https://twitter.com/SAP_Gsupport/status/524138333065449472 •
CVSS: 5.0EPSS: 9%CPEs: 2EXPL: 0CVE-2014-8592
https://notcve.org/view.php?id=CVE-2014-8592
Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via a crafted request. Vulnerabilidad no especificada en SAP Host Agent, utilizado en SAP NetWeaver 7.02 y 7.3, permite a atacantes remotos causar una denegación de servicio (terminación de proceso) a través de una solicitud manipulada. • http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition https://erpscan.io/advisories/erpscan-14-017-sap-netweaver-http-partial-http-post-requests-dos https://erpscan.io/advisories/erpscan-14-018-sap-netweaver-j2ee-engine-partial-http-post-requests-dos https://erpscan.io/advisories/erpscan-14-019-sap-netweaver-j2ee-engine-partial-http-post-requests-dos https://erpscan.io/advisories/erpscan-14-020-sap-netweaver-management-console-gsaop-partial-http-requests-dos https://erpscan.io/advisories/erps •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-7094
https://notcve.org/view.php?id=CVE-2013-7094
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la función RSDDCVER_COUNT_TAB_COLS de SAP NetWeaver 7.30 permite a atacantes remotos ejecutar comandos SQL de forma arbitraria a través de vectores no especificados. • http://scn.sap.com/docs/DOC-8218 http://secunia.com/advisories/56061 http://www.securityfocus.com/bid/64232 https://erpscan.io/advisories/erpscan-13-022-sap-netweaver-rsddcver_count_tab_cols-potential-sql-injection https://exchange.xforce.ibmcloud.com/vulnerabilities/89603 https://service.sap.com/sap/support/notes/1836718 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •