CVSS: 7.5EPSS: 97%CPEs: 1EXPL: 3CVE-2016-3976 – SAP NetWeaver Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2016-3976
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971. Vulnerabilidad de salto de directorio en SAP NetWeaver AS Java 7.1 hasta la versión 7.5 permite a atacantes remotos leer archivos arbitrarios a través de ..\ (punto punto barra invertida) en el parámetro fileName para CrashFileDownloadServlet, también conocida como SAP Security Note 2234971. SAP NetWeaver AS JAVA versions 7.1 through 7.5 suffer from a directory traversal vulnerability. SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files. • https://www.exploit-db.com/exploits/39996 http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html http://seclists.org/fulldisclosure/2016/Jun/40 https://erpscan.io/advisories/erpscan-16-012 https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review https://launchpad.support.sap.com/#/notes/2234971 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2016-3975 – SAP NetWeaver AS JAVA 7.5 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2016-3975
Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP Security Note 2238375. Vulnerabilidad de XSS en SAP NetWeaver AS Java 7.1 hasta la versión 7.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro navigationTarget para irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, también conocida como SAP Security Note 2238375. SAP NetWeaver AS JAVA versions 7.1 through 7.5 suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/137529/SAP-NetWeaver-AS-JAVA-7.5-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2016/Jun/42 https://erpscan.io/advisories/erpscan-16-014-sap-netweaver-7-4-navigationurltester https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 3CVE-2016-3974 – SAP NetWeaver AS JAVA 7.1 < 7.5 - 'ctcprotocol Servlet' XML External Entity
https://notcve.org/view.php?id=CVE-2016-3974
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994. Vulnerabilidad de XXE en Configuration Wizard en SAP NetWeaver Java AS 7.1 hasta la versión 7.5 permite a atacantes remotos provocar una denegación de servicio, llevar a cabo ataques SMB Relay o acceder a archivos arbitrarios a través de una petición XML manipulada para _tc~monitoring~webservice~web/ServerNodesWSService, también conocida como SAP Security Note 2235994. SAP NetWeaver AS JAVA versions 7.1 through 7.5 suffer from an XML external entity injection vulnerability. • https://www.exploit-db.com/exploits/39995 http://packetstormsecurity.com/files/137527/SAP-NetWeaver-AS-JAVA-7.5-XXE-Injection.html http://seclists.org/fulldisclosure/2016/Jun/41 https://erpscan.io/advisories/erpscan-16-013-sap-netweaver-7-4-ctcprotocol-servlet-xxe https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-3973 – SAP NetWeaver AS JAVA 7.5 Information Disclosure
https://notcve.org/view.php?id=CVE-2016-3973
The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Chat#, pressing "Add users", and doing a search, aka SAP Security Note 2255990. La característica de chat en los servicios Real-Time Collaboration (RTC) 7.3 y 7.4 en SAP NetWeaver Java AS 7.1 hasta la versión 7.5 permite a atacantes remotos obtener información sensible de usuario visitando webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Chat#, presionando "Add users" y haciendo una búsqueda, también conocido como SAP Security Note 2255990. SAP NetWeaver AS JAVA versions 7.1 through 7.5 suffer form an information disclosure vulnerability in WD_CHAT. • http://packetstormsecurity.com/files/137579/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html http://seclists.org/fulldisclosure/2016/Jun/46 https://erpscan.io/advisories/erpscan-16-016-sap-netweaver-7-4-information-disclosure-wd_chat https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 16%CPEs: 1EXPL: 1CVE-2016-2389 – SAP xMII 15.0 - Directory Traversal
https://notcve.org/view.php?id=CVE-2016-2389
Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978. Vulnerabilidad de salto de directorio en la función GetFileList en el componente SAP Manufacturing Integration and Inteligence (xMII) 15.0 para SAP NetWeaver 7.4 permite a atacantes romotos leer archivos arbitrarios a través de .. (punto punto) en el parametro Path para /Catalog, también conocido como SAP Security Note 2230978. • https://www.exploit-db.com/exploits/39837 http://packetstormsecurity.com/files/137046/SAP-MII-15.0-Directory-Traversal.html http://seclists.org/fulldisclosure/2016/May/40 https://erpscan.io/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •