CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2020-26819
https://notcve.org/view.php?id=CVE-2020-26819
10 Nov 2020 — SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that allows them to read and delete database logfiles because of Improper Access Control. SAP NetWeaver AS ABAP (Web Dynpro), versiones - 731, 740, 750, 751, 752, 753, 754, 755, 782, permite a un usuario autenticado acceder a los componentes de Web Dynpro, lo que luego permite leer y eliminar archivos de registro de la base de datos debido a un Control de ... • https://launchpad.support.sap.com/#/notes/2971954 •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6371
https://notcve.org/view.php?id=CVE-2020-6371
15 Oct 2020 — User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP (POWL test application) versions - 710, 711, 730, 731, 740, 750, leading to Information Disclosure. Una vulnerabilidad de enumeración de usuarios puede ser explotada para obtener una lista de cuentas de usuario y la información personal del usuario puede ser expuesta en SAP NetWeaver Application Server ABAP (aplicación de prueba POWL): versiones... • https://launchpad.support.sap.com/#/notes/2963137 •
CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 0CVE-2020-6310
https://notcve.org/view.php?id=CVE-2020-6310
12 Aug 2020 — Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure. Un control de acceso inapropiado en el componente SOA Configuration Trace en SAP NetWeaver (ABAP Server) y la plataforma ABAP, versiones - 702, 730, 731, 740, 750, permite a cualquier usuario autenticado enumerar todos los usuarios de SAP, conllevando a una Divulgación de... • https://launchpad.support.sap.com/#/notes/2944988 •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2020-6299
https://notcve.org/view.php?id=CVE-2020-6299
12 Aug 2020 — SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value help, leading to Information Disclosure. SAP NetWeaver (ABAP Server) y la plataforma ABAP, versiones - 740, 750, 751, 752, 753, 754, 755, permiten a un usuario empresarial acceder a la lista de usuarios en el sistema dado usando la ayuda de valor, conllevando a una Divulgación de Información • https://launchpad.support.sap.com/#/notes/2941510 •
CVSS: 8.8EPSS: 0%CPEs: 22EXPL: 0CVE-2020-6296
https://notcve.org/view.php?id=CVE-2020-6296
12 Aug 2020 — SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application. SAP NetWeaver (ABAP Server) y plataforma ABAP, versiones: 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, permiten a un atacante inyectar código que puede ser ejecutado por la aplicación conllevando a una Inyecció... • https://launchpad.support.sap.com/#/notes/2941667 •
CVSS: 4.0EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6280
https://notcve.org/view.php?id=CVE-2020-6280
14 Jul 2020 — SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure. SAP NetWeaver (ABAP Server) y ABAP Platform, versiones 731, 740, 750, permiten a un atacante con privilegios de administrador acceder a determinados archivos que de otro modo deberían estar restringidos, conllevando a una Divulgación de Información • https://launchpad.support.sap.com/#/notes/2927373 •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2020-6275
https://notcve.org/view.php?id=CVE-2020-6275
10 Jun 2020 — SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database. SAP Netweaver AS ABAP, version... • https://launchpad.support.sap.com/#/notes/2912939 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2020-6270
https://notcve.org/view.php?id=CVE-2020-6270
10 Jun 2020 — SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user leading to wrong prices. SAP NetWeaver AS ABAP (Banking Services), versiones: 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, no realiza las comprobaciones de autorización necesarias para un usuario autent... • https://launchpad.support.sap.com/#/notes/2916562 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-6240
https://notcve.org/view.php?id=CVE-2020-6240
12 May 2020 — SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service SAP NetWeaver AS ABAP (Web Dynpro ABAP), versiones (SAP_UI 750, 752, 753, 754 y SAP_BASIS 700, 710, 730, 731, 804), permite a un atacante no autenticado impedir a usuarios legítimos el acceso a un servicio, ya sea mediante el bloqueo o... • https://launchpad.support.sap.com/#/notes/2856923 •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-0321
https://notcve.org/view.php?id=CVE-2019-0321
10 Jul 2019 — ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. ABAP Server y ABAP Platform (SAP Basis), versiones 7.31, 7.4, 7.5, no codifican de manera suficiente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo cross-site scripting (XSS). • http://www.securityfocus.com/bid/109078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •