CVSS: 7.5EPSS: 3%CPEs: 2EXPL: 5CVE-2014-0995 – SAP NetWeaver Enqueue Server - Denial of Service
https://notcve.org/view.php?id=CVE-2014-0995
16 Oct 2014 — The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern. El servidor Standalone Enqueue en SAP Netweaver 7.20, 7.01, y anteriores permite a atacantes remotos causar una denegación de servicio (recursión sin control y caída) a través de un nivel de traza con un comodín en la pauta de traza (Trace Pattern). Core Security Technologies Advisory - A vulnera... • https://packetstorm.news/files/id/128726 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2014-6252
https://notcve.org/view.php?id=CVE-2014-6252
05 Sep 2014 — Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors. Desbordamiento de buffer en disp+work.exe 7000.52.12.34966 y 7200.117.19.50294 en el distribuidor de la plataforma SAP NetWeaver 7.00 y 7.20 permite a usuarios remotos autenticados causar una denegación de servicio o ejecutar código arbitrario a través de vectores no especific... • http://scn.sap.com/docs/DOC-8218 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5174
https://notcve.org/view.php?id=CVE-2014-5174
31 Jul 2014 — The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive information via unspecified vectors. El componente SAP Netweaver Business Warehouse no restringe debidamente el acceso a las funciones en el grupo de funciones BW-SYS-DB-DB4, lo que permite a usuarios remotos autenticados obtener información sensible a través de vectores no especificados. • http://packetstormsecurity.com/files/127671/SAP-Netweaver-Business-Warehouse-Missing-Authorization.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-4160
https://notcve.org/view.php?id=CVE-2014-4160
13 Jun 2014 — Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) sap-accessibility parameter. Múltiples vulnerabilidades de XSS en el nodo testcanvas en SAP NetWeaver Business Client (NWBC) permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) title o (2) sap-accessibility. • http://blog.emaze.net/2014/05/sap-multiple-vulnerabilities.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2014-4003
https://notcve.org/view.php?id=CVE-2014-4003
09 Jun 2014 — The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system. El componente System Landscape Directory (SLD) en SAP NetWeaver permite a atacantes remotos modificar información a través de vectores relacionados con añadir un sistema. • http://packetstormsecurity.com/files/126986/SAP-SLD-Information-Tampering.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2014-3787
https://notcve.org/view.php?id=CVE-2014-3787
19 May 2014 — SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors. SAP NetWeaver 7.20 y anteriores permite a atacantes remotos leer tablas de SAP Central User Administration (SAP CUA) arbitrarias a través de vectores no especificados. • http://en.securitylab.ru/lab/PT-2014-09 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3133
https://notcve.org/view.php?id=CVE-2014-3133
30 Apr 2014 — SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to SystemSelection. SAP Netweaver Java Application Server no restringe debidamente acceso, lo que permite a atacantes remotos obtener la lista de sistemas SAP registrados en un SLD a través de un webdynpro no especificado, relacionado con SystemSelection. • http://scn.sap.com/docs/DOC-8218 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3129
https://notcve.org/view.php?id=CVE-2014-3129
30 Apr 2014 — The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. Java Server Pages en Software Lifecycle Manager (SLM) en SAP NetWeaver permite a atacantes remotos obtener información sensible a través de una solicitud manipulada, relacionado con SAP Solution Manager 7.1. • http://scn.sap.com/docs/DOC-8218 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3130
https://notcve.org/view.php?id=CVE-2014-3130
30 Apr 2014 — The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and execute ABAP instructions via crafted help messages. Las herramientas de documentación y traducción ABAP Help (BC-DOC-HLP) en Basis en SAP Netweaver ABAP Application Server no restringe debidamente acceso, lo que permite a usuarios locales ganar privilegios y ejecutar instrucciones ABAP a través de mensajes de ayud... • http://scn.sap.com/docs/DOC-8218 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-7364
https://notcve.org/view.php?id=CVE-2013-7364
10 Apr 2014 — An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors. Un servicio del núcleo de J2EE no especificado en J2EE Engine en SAP NetWeaver no restringe debidamente el acceso, lo que permite a atacantes remotos leer o escribir hacia archivos arbitrarios a través de vectores desconocidos. • http://archives.neohapsis.com/archives/bugtraq/2013-02/0133.html • CWE-264: Permissions, Privileges, and Access Controls •