Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

sap netweaver application server java vulnerabilities and exploits

(subscribe to this query)
10
CVSSv3
CVE-2022-22536
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitra...
Sap Netweaver Application Server Abap Krnl64nuc 7.49Sap Netweaver Application Server Abap Krnl64uc 7.49Sap Netweaver Application Server Abap Krnl64uc 7.53Sap Web Dispatcher 7.53Sap Web Dispatcher 7.77Sap Web Dispatcher 7.81Sap Web Dispatcher 7.22extSap Web Dispatcher 7.49Sap Content Server 7.53Sap Web Dispatcher 7.85Sap Web Dispatcher 7.86Sap Web Dispatcher 7.87Sap Netweaver Application Server Abap Krnl64nuc 7.22Sap Netweaver Application Server Abap Krnl64nuc 7.22extSap Netweaver Application Server Abap Krnl64uc 8.04Sap Netweaver Application Server Abap Krnl64uc 7.22Sap Netweaver Application Server Abap Krnl64uc 7.22extSap Netweaver Application Server Abap 7.22Sap Netweaver Application Server Abap 7.49Sap Netweaver Application Server Abap 7.53Sap Netweaver Application Server Abap 7.77Sap Netweaver Application Server Abap 7.81
10
CVSSv3
CVE-2020-26829
SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal clus...
Sap Netweaver Application Server Java 7.11Sap Netweaver Application Server Java 7.20Sap Netweaver Application Server Java 7.30Sap Netweaver Application Server Java 7.31Sap Netweaver Application Server Java 7.40Sap Netweaver Application Server Java 7.50
10
CVSSv3
CVE-2020-6287
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the...
Sap Netweaver Application Server Java 7.30Sap Netweaver Application Server Java 7.31Sap Netweaver Application Server Java 7.40Sap Netweaver Application Server Java 7.50
10
CVSSv3
CVE-2010-5326
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly prior to 7.3, does not require authentication, which allows remote malicious users to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "D...
Sap Netweaver Application Server Java
9.8
CVSSv3
CVE-2023-40309
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could a...
Sap Netweaver Application Server Abap Kernel 7.53Sap Netweaver Application Server Abap Kernel 7.77Sap Web Dispatcher 7.53Sap Web Dispatcher 7.77Sap Web Dispatcher 7.22extSap Content Server 7.53Sap Web Dispatcher 7.85Sap Netweaver Application Server Abap Kernel 7.22Sap Netweaver Application Server Abap Kernel 8.04Sap Netweaver Application Server Abap 7.22extSap Netweaver Application Server Abap Kernel 7.85Sap Web Dispatcher 7.89Sap Web Dispatcher 7.54Sap Netweaver Application Server Abap Kernel 7.89Sap Netweaver Application Server Abap Kernel 7.54Sap Netweaver Application Server Abap Kernel 7.92Sap Netweaver Application Server Abap Kernel 7.93Sap Content Server 6.50Sap Content Server 7.54Sap Hana Database 2.0Sap Host Agent 722Sap Extended Application Services And Runtime 1.0
9.8
CVSSv3
CVE-2023-0017
An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and da...
Sap Netweaver Application Server For Java 7.50
9.8
CVSSv3
CVE-2022-22532
In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This coul...
Sap Netweaver Application Server Java 7.22Sap Netweaver Application Server Java 7.49Sap Netweaver Application Server Java 7.53Sap Netweaver Application Server Java Krnl64uc 7.22Sap Netweaver Application Server Java Krnl64uc 7.22extSap Netweaver Application Server Java Krnl64uc 7.49Sap Netweaver Application Server Java Krnl64nuc 7.22Sap Netweaver Application Server Java Krnl64nuc 7.22extSap Netweaver Application Server Java Krnl64nuc 7.49
9.8
CVSSv3
CVE-2021-37535
SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for user privileges.
Sap Netweaver Application Server Java 7.11Sap Netweaver Application Server Java 7.20Sap Netweaver Application Server Java 7.30Sap Netweaver Application Server Java 7.31Sap Netweaver Application Server Java 7.40Sap Netweaver Application Server Java 7.50
9.8
CVSSv3
CVE-2020-6263
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for o...
Sap Netweaver Application Server Java 7.00Sap Netweaver Application Server Java 7.01Sap Netweaver Application Server Java 7.02Sap Netweaver Application Server Java 7.05Sap Netweaver Application Server Java 7.10Sap Netweaver Application Server Java 7.11Sap Netweaver Application Server Java 7.20Sap Netweaver Application Server Java 7.30Sap Netweaver Application Server Java 7.31Sap Netweaver Application Server Java 7.40Sap Netweaver Application Server Java 7.50
9.8
CVSSv3
CVE-2019-0345
A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credential...
Sap Netweaver Application Server Java 7.30Sap Netweaver Application Server Java 7.31Sap Netweaver Application Server Java 7.40Sap Netweaver Application Server Java 7.50
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654CVE-2024-2757authentication bypassCVE-2024-3194CVE-2024-33640CVE-2024-21111dosinsecure direct object referenceCVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook