CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2021-42067
https://notcve.org/view.php?id=CVE-2021-42067
14 Jan 2022 — In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible. En SAP NetWeaver AS for ABAP y ABAP Platform - versiones 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, un atacante autenticado como usuario norma... • https://launchpad.support.sap.com/#/notes/3112710 •
CVSS: 7.2EPSS: 0%CPEs: 15EXPL: 0CVE-2021-44235
https://notcve.org/view.php?id=CVE-2021-44235
14 Dec 2021 — Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the operating system, that could highly impact the Confidentiality, Integrity and Availability of the system. Dos métodos de una clase de utilidad en SAP NetWeaver AS ABA... • https://launchpad.support.sap.com/#/notes/3123196 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 20EXPL: 0CVE-2021-44231
https://notcve.org/view.php?id=CVE-2021-44231
14 Dec 2021 — Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application. Los informes de extracción de texto usados internamente permiten a un atacante inyectar código que puede ser ejecutado por la aplicación. Un atacante podría así controlar el comportamiento de la aplicación • https://launchpad.support.sap.com/#/notes/3119365 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.9EPSS: 0%CPEs: 15EXPL: 0CVE-2021-40504
https://notcve.org/view.php?id=CVE-2021-40504
10 Nov 2021 — A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contains transport authorizations, which exceed expected display only permissions. Un determinado rol de plantilla en SAP NetWeaver Application Server para ABAP y ABAP Platform - versiones 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, contiene autorizaciones de transporte, que exceden los permisos esperados d... • https://launchpad.support.sap.com/#/notes/3105728 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 28EXPL: 0CVE-2021-40496
https://notcve.org/view.php?id=CVE-2021-40496
12 Oct 2021 — SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit the authentication function by using POST and form field to repeat executions of the initial command by a GET request and exposing sensitive data. This vulnerability is normally exposed over the network and successful exploitation can lead to exposure of data like system details. SAP Internet Communication framework (ICM) - versio... • https://launchpad.support.sap.com/#/notes/3087254 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 28EXPL: 0CVE-2021-38178
https://notcve.org/view.php?id=CVE-2021-38178
12 Oct 2021 — The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data. El sistema de logística de software de SAP NetWeaver AS ABAP y ABAP Platform ver... • https://launchpad.support.sap.com/#/notes/3097887 •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2021-38181
https://notcve.org/view.php?id=CVE-2021-38181
12 Oct 2021 — SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. SAP NetWeaver AS ABAP y ABAP Platform - versiones 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, permite a un atacante impedir que los usuarios legítimos accedan a un servicio, ya sea al bloquear o inundar el servicio • https://launchpad.support.sap.com/#/notes/3080710 •
CVSS: 10.0EPSS: 68%CPEs: 4EXPL: 4CVE-2013-1592 – SAP NetWeaver Message Server - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1592
15 Feb 2013 — A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. Se presenta una vulnerabilidad de Desbordamiento de Búfer en la función _MsJ2EE_AddStatistics() del servicio Message Server cuando se envían paquetes de SAP Message Server especialmente diseñ... • https://packetstorm.news/files/id/120350 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 2CVE-2013-1593 – SAP Netweaver Message Server Buffer Overflow
https://notcve.org/view.php?id=CVE-2013-1593
15 Feb 2013 — A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP Message Server packet to TCP ports 36NN and/or 39NN. Se presenta una vulnerabilidad de Denegación de Servicio en la función WRITE_C en el módulo msg_server.exe en SAP NetWeaver 2004s, versiones 7.01 SR1, 7.02 SP06 y 7.30 SP04, cuando se envía un paquete de SAP Message Server diseñado hacia los puertos TCP 36NN y/o 39NN. Core Secur... • https://packetstorm.news/files/id/120350 • CWE-129: Improper Validation of Array Index •