CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2014-6252
https://notcve.org/view.php?id=CVE-2014-6252
Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors. Desbordamiento de buffer en disp+work.exe 7000.52.12.34966 y 7200.117.19.50294 en el distribuidor de la plataforma SAP NetWeaver 7.00 y 7.20 permite a usuarios remotos autenticados causar una denegación de servicio o ejecutar código arbitrario a través de vectores no especificados. • http://scn.sap.com/docs/DOC-8218 http://secunia.com/advisories/60496 https://erpscan.io/advisories/erpscan-14-011-sap-netweaver-dispatcher-buffer-overflow-rce-dos https://exchange.xforce.ibmcloud.com/vulnerabilities/96196 https://service.sap.com/sap/support/notes/2018221 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-3787
https://notcve.org/view.php?id=CVE-2014-3787
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors. SAP NetWeaver 7.20 y anteriores permite a atacantes remotos leer tablas de SAP Central User Administration (SAP CUA) arbitrarias a través de vectores no especificados. • http://en.securitylab.ru/lab/PT-2014-09 http://scn.sap.com/docs/DOC-8218 http://secunia.com/advisories/58671 https://service.sap.com/sap/support/notes/1997455 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2014-1963
https://notcve.org/view.php?id=CVE-2014-1963
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors. Vulnerabilidad no especificada en Message Server en SAP NetWeaver 7.20 permite a atacantes remotos causar una denegación de servicio a través de vectores de ataque desconocidos. • http://scn.sap.com/docs/DOC-8218 http://secunia.com/advisories/56947 https://erpscan.io/advisories/erpscan-14-001-sap-netweaver-message-server-dos https://exchange.xforce.ibmcloud.com/vulnerabilities/91097 https://service.sap.com/sap/support/notes/1773912 •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2014-1965
https://notcve.org/view.php?id=CVE-2014-1965
Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP. Vulnerabilidad de XSS en ISpeakAdapter en Integration Repository en el componente SAP Exchange Infrastructure (BC-XI) 3.0, 7.00 hasta 7.02 y 7.10 hasta 7.11 para SAP NetWeaver permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores relacionados con PIP. • http://secunia.com/advisories/56947 http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517 https://erpscan.io/advisories/erpscan-14-006-sap-netweaver-pip-xss https://exchange.xforce.ibmcloud.com/vulnerabilities/91094 https://service.sap.com/sap/support/notes/1442517 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-7094
https://notcve.org/view.php?id=CVE-2013-7094
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la función RSDDCVER_COUNT_TAB_COLS de SAP NetWeaver 7.30 permite a atacantes remotos ejecutar comandos SQL de forma arbitraria a través de vectores no especificados. • http://scn.sap.com/docs/DOC-8218 http://secunia.com/advisories/56061 http://www.securityfocus.com/bid/64232 https://erpscan.io/advisories/erpscan-13-022-sap-netweaver-rsddcver_count_tab_cols-potential-sql-injection https://exchange.xforce.ibmcloud.com/vulnerabilities/89603 https://service.sap.com/sap/support/notes/1836718 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •