10 results (0.009 seconds)

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2

CVE-2015-7241 – SAP NetWeaver < 7.01 - XML External Entity Injection

https://notcve.org/view.php?id=CVE-2015-7241

XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. Existe una vulnerabilidad de tipo XML External Entity (XEE) en versiones de SAP Netweaver anteriores a la 7.01. SAP Netweaver versions prior to 7.01 suffer from an XXE injection vulnerability. • https://www.exploit-db.com/exploits/38261 http://packetstormsecurity.com/files/133627/SAP-Netweaver-XML-External-Entity-Injection.html http://www.securityfocus.com/archive/1/536504/100/0/threaded http://www.securityfocus.com/bid/76809 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2014-9569

https://notcve.org/view.php?id=CVE-2014-9569

Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Business Client (NWBC) for HTML 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) roundtrips parameter, aka SAP Security Note 2051285. Múltiples vulnerabilidades de XSS en SAP NetWeaver Business Client (NWBC) para HTML 3.0 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) title o (2) roundtrips, también conocido como SAP Security Note 2051285. • http://secunia.com/advisories/62017 http://www.securitytracker.com/id/1031509 http://www.senseofsecurity.com.au/advisories/SOS-14-005 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 3%CPEs: 2EXPL: 4

CVE-2014-0995 – SAP NetWeaver Enqueue Server - Denial of Service

https://notcve.org/view.php?id=CVE-2014-0995

The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern. El servidor Standalone Enqueue en SAP Netweaver 7.20, 7.01, y anteriores permite a atacantes remotos causar una denegación de servicio (recursión sin control y caída) a través de un nivel de traza con un comodín en la pauta de traza (Trace Pattern). • https://www.exploit-db.com/exploits/35000 http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition http://packetstormsecurity.com/files/128726/SAP-Netweaver-Enqueue-Server-Trace-Pattern-Denial-Of-Service.html http://seclists.org/fulldisclosure/2014/Oct/76 http://secunia.com/advisories/60950 http://www.coresecurity.com/advisories/sap-netweaver-enqueue-server-trace-pattern-denial-service-vulnerability http://www.securityfocus.com/archive/1/533719/100/0/threaded https://exchange.xforce.ibmclou • CWE-20: Improper Input Validation •

CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0

CVE-2014-3787

https://notcve.org/view.php?id=CVE-2014-3787

SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors. SAP NetWeaver 7.20 y anteriores permite a atacantes remotos leer tablas de SAP Central User Administration (SAP CUA) arbitrarias a través de vectores no especificados. • http://en.securitylab.ru/lab/PT-2014-09 http://scn.sap.com/docs/DOC-8218 http://secunia.com/advisories/58671 https://service.sap.com/sap/support/notes/1997455 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2014-1965

https://notcve.org/view.php?id=CVE-2014-1965

Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP. Vulnerabilidad de XSS en ISpeakAdapter en Integration Repository en el componente SAP Exchange Infrastructure (BC-XI) 3.0, 7.00 hasta 7.02 y 7.10 hasta 7.11 para SAP NetWeaver permite a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores relacionados con PIP. • http://secunia.com/advisories/56947 http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517 https://erpscan.io/advisories/erpscan-14-006-sap-netweaver-pip-xss https://exchange.xforce.ibmcloud.com/vulnerabilities/91094 https://service.sap.com/sap/support/notes/1442517 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •