CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-0312
https://notcve.org/view.php?id=CVE-2019-0312
12 Jun 2019 — Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings. Varias páginas web proporcionadas SAP NetWeaver Process Integration (versiones: SAP_XIESR: 7.10 a 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 y SAP_XITOOL: 7.10 ... • https://launchpad.support.sap.com/#/notes/2744086 • CWE-306: Missing Authentication for Critical Function •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-0305
https://notcve.org/view.php?id=CVE-2019-0305
12 Jun 2019 — Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data. Las páginas de servidor Java (JSP) proporcionadas por la integración de procesos de SAP NetWeaver (SAP_XIESR y SAP_XITO... • https://launchpad.support.sap.com/#/notes/2755502 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-0283
https://notcve.org/view.php?id=CVE-2019-0283
10 Apr 2019 — SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document. SAP NetWeaver Process Integration (Adapter Engine), ejecutado en las versiones 7.10 hasta 7.11, ... • https://launchpad.support.sap.com/#/notes/2747683 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-0282
https://notcve.org/view.php?id=CVE-2019-0282
10 Apr 2019 — Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker. Varias páginas web en SAP NetWeaver Process Integration (Runtime Workbench), corregidas en las versiones 7.10 hasta 7.11, 7.30, 7.31, 7.40, 7.50; puede ser accedida sin la autenticación del usuario, lo q... • https://launchpad.support.sap.com/#/notes/2742758 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-0278
https://notcve.org/view.php?id=CVE-2019-0278
10 Apr 2019 — Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure. Bajo ciertas condiciones, el Servlet de monitoreo de NetWeaver Process Integration (Sistema de Mensajería), corregido en las versiones 7.10 hasta 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite que un atacante vea los nombres de l... • https://launchpad.support.sap.com/#/notes/2741201 •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2019-0248
https://notcve.org/view.php?id=CVE-2019-0248
08 Jan 2019 — Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted. Bajo ciertas condiciones, SAP Gateway of ABAP Application Server (solucionado en SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) permite que un atacante acceda a información que normalmente estaría restringida. • http://www.securityfocus.com/bid/106471 •
CVSS: 7.4EPSS: 0%CPEs: 6EXPL: 0CVE-2018-2503
https://notcve.org/view.php?id=CVE-2018-2503
11 Dec 2018 — By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50). Por defecto, el almacén de claves Java de SAP NetWeaver AS no restringe lo suficiente el acceso a recursos que deberían estar protegidos. Esto ha sido solucionado en SAP NetWeaver AS Java (ServerCore en versiones 7.11, 7.20, 7.30, 7.31, 7.40 y 7.50). • http://www.securityfocus.com/bid/106156 • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2018-2504
https://notcve.org/view.php?id=CVE-2018-2504
11 Dec 2018 — SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting (XSS) vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50. El servicio Java Web Container, de SAP NetWeaver AS, no valida contra una lista blanca la cabecera HTTP del host, lo que puede resultar en una vulnerabilidad de manipulación de la cabecera HTTP del host o de Cross-Site Scripting (XSS). La vulnerabi... • http://www.securityfocus.com/bid/106150 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-2470
https://notcve.org/view.php?id=CVE-2018-2470
09 Oct 2018 — In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. En SAP NetWeaver Application Server for ABAP desde la versión 7.0 hasta la 7.02, 7.30, 7.31, 7.40 y de la versión 7.50 a la 7.53, las aplicaciones no cifran lo suficiente las entradas controladas por el usuario, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/105551 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2018-2452
https://notcve.org/view.php?id=CVE-2018-2452
11 Sep 2018 — The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability. La aplicación de inicio de sesión de SAP NetWeaver AS Java desde la versión 7.10 hasta la 7.11, 7.20, 7.30, 7.31, 7.40 y 7.50, no cifra lo suficiente las entradas controladas por el usuario, lo que resulta en una vulnerabilidad de Cross-Site Scripting (XSS). • http://www.securityfocus.com/bid/105325 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •