Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

sap netweaver process integration 7.40 vulnerabilities and exploits

(subscribe to this query)
6.5
CVSSv3
CVE-2021-27599
SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an malicious user to access information under certain conditions, which would otherwise be restricted.
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
4.3
CVSSv3
CVE-2019-0356
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (prior to 7.31, 7.40, 7.50) allows an malicious user to access information which would otherwise be restricted.
Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40
6.5
CVSSv3
CVE-2021-27604
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
7.1
CVSSv3
CVE-2019-0283
SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be ac...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.50
5.3
CVSSv3
CVE-2019-0282
Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
6.1
CVSSv3
CVE-2019-0337
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an malicious user to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS)...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
7.5
CVSSv3
CVE-2019-0315
Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 and SAP_XIPCK 7.10 to 7.11, 7.20, 7.30) allows an malicious user to a...
Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.20
4.3
CVSSv3
CVE-2019-0278
Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an malicious user to see the names of database tables used by the application, leading to information ...
Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.20
4.8
CVSSv3
CVE-2019-0316
SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by ...
Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.50
4.3
CVSSv3
CVE-2019-0305
Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjac...
Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.31
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654CVE-2024-2757authentication bypassCVE-2024-3194CVE-2024-33640CVE-2024-21111dosinsecure direct object referenceCVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook