CVSS: 4.0EPSS: 1%CPEs: 1EXPL: 2CVE-2012-1289
https://notcve.org/view.php?id=CVE-2012-1289
Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3) ipc/admin/log.jsp or (4) ipc/admin/log_view.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component. Múltiples vulnerabilidades de salto de directorio en la plataforma SAP NetWeaver v7.0 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de un .. (punto punto) en el parámetro logfilename a (1) b2b/admin/log.jsp o (2) b2b/admin/log_view.jsp en las ventas por Internet (crm.b2b), componente, o (3) ipc / admin log / . jsp o (4) los componentes del IPC / admin / log_view.jsp en la Administración de aplicaciones (com.sap.ipc.webapp.ipc) .. • http://dsecrg.com/pages/vul/show.php?id=412 http://dsecrg.com/pages/vul/show.php?id=413 http://secunia.com/advisories/47861 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a http://www.securityfocus.com/bid/52101 https://exchange.xforce.ibmcloud.com/vulnerabilities/73346 https://service.sap.com/sap/support/notes/1585527 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2012-1292
https://notcve.org/view.php?id=CVE-2012-1292
Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors. Vulnerabilidad no especificada en el servlet MessagingSystem en SAP NetWeaver v7.0 permite a atacantes remotos obtener información sensible acerca de los datos de rendimiento a través de vectores no especificados MessagingSystem. • http://dsecrg.com/pages/vul/show.php?id=416 http://secunia.com/advisories/47861 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a http://www.securityfocus.com/bid/52101 https://service.sap.com/sap/support/notes/1585527 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-1290
https://notcve.org/view.php?id=CVE-2012-1290
Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en b2b/auction/container.jsp en las ventas por Internet (crm.b2b) módulo en la plataforma SAP NetWeaver v7.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro _loadPage. • http://dsecrg.com/pages/vul/show.php?id=414 http://secunia.com/advisories/47861 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a http://www.securityfocus.com/bid/52101 https://service.sap.com/sap/support/notes/1583300 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2012-1291
https://notcve.org/view.php?id=CVE-2012-1291
Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servlet_jsp service. Una vulnerabilidad no especificada en el servlet com.sap.aii.mdt.amt.web.AMTPageProcessor en SAP NetWeaver v7.0 permite a atacantes remotos obtener información sensible sobre el "Adapter Monitor" a través de vectores no especificados. Posiblemente la vulnerabilidad esta relacionada con la propiedad EnableInvokerServletGlobally en el servicio servlet_jsp. • http://dsecrg.com/pages/vul/show.php?id=415 http://secunia.com/advisories/47861 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a http://www.securityfocus.com/bid/52101 https://service.sap.com/sap/support/notes/1585527 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4707
https://notcve.org/view.php?id=CVE-2011-4707
Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en el Virus Scan Interface en SAP Netweaver, permite a usuarios remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) instname en el servlet VsiTestScan y (2) name en el servlet VsiTestServlet. • http://dsecrg.com/pages/vul/show.php?id=336 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a http://www.securityfocus.com/archive/1/520554/100/0/threaded https://erpscan.io/advisories/dsecrg-11-036-sap-netwaver-virus-scan-interface-multiple-xss https://service.sap.com/sap/support/notes/1546307 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •