Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

sap netweaver process integration 7.50 vulnerabilities and exploits

(subscribe to this query)
6.5
CVSSv3
CVE-2021-27599
SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an malicious user to access information under certain conditions, which would otherwise be restricted.
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
6.1
CVSSv3
CVE-2019-0337
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an malicious user to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS)...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
6.5
CVSSv3
CVE-2021-27604
In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
5.3
CVSSv3
CVE-2019-0282
Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
7.1
CVSSv3
CVE-2019-0283
SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be ac...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.50
4.3
CVSSv3
CVE-2019-0356
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (prior to 7.31, 7.40, 7.50) allows an malicious user to access information which would otherwise be restricted.
Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40
4.9
CVSSv3
CVE-2021-27618
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file type extension of the file uploaded from local source. An attacker could craft a malicious file and upload it to the application, which could ...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50
4.9
CVSSv3
CVE-2021-27617
The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, co...
Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.20
4.3
CVSSv3
CVE-2019-0305
Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjac...
Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.40Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.31
5.3
CVSSv3
CVE-2019-0312
Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or...
Sap Netweaver Process Integration 7.50Sap Netweaver Process Integration 7.20Sap Netweaver Process Integration 7.10Sap Netweaver Process Integration 7.11Sap Netweaver Process Integration 7.30Sap Netweaver Process Integration 7.31Sap Netweaver Process Integration 7.40
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654CVE-2024-2757authentication bypassCVE-2024-3194CVE-2024-33640CVE-2024-21111dosinsecure direct object referenceCVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook