CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42480 – Information Disclosure in NetWeaver AS Java Logon
https://notcve.org/view.php?id=CVE-2023-42480
14 Nov 2023 — The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability. El atacante no autenticado en la aplicación NetWeaver AS Java Logon versión 7.50 puede forzar la funcionalidad de inicio de sesión para identificar los ID de usuario legítimos. Esto tendrá un impacto en la confidencialidad, pero no hay ningún otro ... • https://me.sap.com/notes/3366410 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42477 – Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)
https://notcve.org/view.php?id=CVE-2023-42477
10 Oct 2023 — SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application. SAP NetWeaver AS Java (aplicación GRMG Heartbeat): versión 7.50, permite a un atacante enviar una solicitud manipulada desde una aplicación web vulnerable, lo que provoca un impacto limitado en la confidencialidad y la integridad de la aplicación. SAP NetWeaver AS Java (GRMG Heartbeat app... • https://me.sap.com/notes/3333426 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41367 – Missing Authentication check in SAP NetWeaver (Guided Procedures)
https://notcve.org/view.php?id=CVE-2023-41367
12 Sep 2023 — Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact. Debido a la falta de verificación de autenticación en la aplicación webdynpro, un usuario no autorizado en SAP NetWeaver ((Guided Procedures) - versión 7.5... • https://me.sap.com/notes/3348142 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37488 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration
https://notcve.org/view.php?id=CVE-2023-37488
08 Aug 2023 — In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of the system. In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack.... • https://me.sap.com/notes/3350494 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35873 – Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)
https://notcve.org/view.php?id=CVE-2023-35873
11 Jul 2023 — The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application. The R... • https://me.sap.com/notes/3343547 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35872 – Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)
https://notcve.org/view.php?id=CVE-2023-35872
11 Jul 2023 — The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application. The ... • https://me.sap.com/notes/3343564 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31405 – Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)
https://notcve.org/view.php?id=CVE-2023-31405
11 Jul 2023 — SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability. • https://me.sap.com/notes/3324732 • CWE-117: Improper Output Neutralization for Logs •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33985 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
https://notcve.org/view.php?id=CVE-2023-33985
13 Jun 2023 — SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application. • https://launchpad.support.sap.com/#/notes/3331627 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33984 – Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository)
https://notcve.org/view.php?id=CVE-2023-33984
13 Jun 2023 — SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability. • https://launchpad.support.sap.com/#/notes/3318657 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30744 – Improper access control during application start-up in SAP AS NetWeaver JAVA.
https://notcve.org/view.php?id=CVE-2023-30744
09 May 2023 — In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication. A subsequent call to one of these methods can read or change the state of existing services without any effect on availability. • https://launchpad.support.sap.com/#/notes/3317453 • CWE-306: Missing Authentication for Critical Function •