sap netweaver application server java 7.30 vulnerabilities and exploits

(subscribe to this query)

10

CVSSv3

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal clus...

Sap Netweaver Application Server Java 7.11 Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

1 Article

10

CVSSv3

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the...

Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

9 Github repositories2 Articles

9.8

CVSSv3

SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for user privileges.

Sap Netweaver Application Server Java 7.11 Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

2 Articles

9.8

CVSSv3

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for o...

Sap Netweaver Application Server Java 7.00 Sap Netweaver Application Server Java 7.01 Sap Netweaver Application Server Java 7.02 Sap Netweaver Application Server Java 7.05 Sap Netweaver Application Server Java 7.10 Sap Netweaver Application Server Java 7.11 Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

9.8

CVSSv3

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credential...

Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

1 Article

7.5

CVSSv3

SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an malicious user to send multiple HTTP requests with different method types thereby crashing the filter and making the HTTP server unavailable to other legitim...

Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50 Sap Netweaver Application Server Java 7.10 Sap Netweaver Application Server Java 7.11

7.5

CVSSv3

SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web service allowing the malicious user to send several payloads and leading to complete denial of service.

Sap Netweaver Application Server Java 7.10 Sap Netweaver Application Server Java 7.11 Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

7.4

CVSSv3

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).

Sap Netweaver Application Server Java 7.11 Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

7.2

CVSSv3

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use...

Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

7.2

CVSSv3

SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation.

Sap Netweaver Application Server Java 7.10 Sap Netweaver Application Server Java 7.20 Sap Netweaver Application Server Java 7.30 Sap Netweaver Application Server Java 7.31 Sap Netweaver Application Server Java 7.40 Sap Netweaver Application Server Java 7.50

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook