SAP

Sap Web Application Server

11 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2008-2421

Exploit
  • EPSS 7.7%
  • Veröffentlicht 23.05.2008 15:32:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the def...

7.8

CVE-2007-3615

  • EPSS 2.24%
  • Veröffentlicht 06.07.2007 19:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-is...

5

CVE-2006-6010

  • EPSS 20.15%
  • Veröffentlicht 21.11.2006 23:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.

5

CVE-2006-6011

  • EPSS 0.56%
  • Veröffentlicht 21.11.2006 23:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a different vulnerability than CV...

4.6

CVE-2006-5784

  • EPSS 3.91%
  • Veröffentlicht 07.11.2006 23:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted data on a "3200+SYSNR" TCP port, as demonstrated by port 3201. NOTE: th...

5

CVE-2006-5785

  • EPSS 1.14%
  • Veröffentlicht 07.11.2006 23:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service (enserver.exe crash) via a 0x72F2 sequence on UDP port 64999.

6.4

CVE-2006-1039

  • EPSS 5.85%
  • Veröffentlicht 07.03.2006 11:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.

5

CVE-2005-3633

Exploit
  • EPSS 0.98%
  • Veröffentlicht 16.11.2005 21:22:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.

5

CVE-2005-3634

Exploit
  • EPSS 2.14%
  • Veröffentlicht 16.11.2005 21:22:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl p...

4.3

CVE-2005-3635

Exploit
  • EPSS 16.61%
  • Veröffentlicht 16.11.2005 21:22:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTE...