VYPR
← SAP

Vendor CVEs

SAP

All CVEs

1,962 total · sorted by risk
  • CVE-2012-1291Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the…

  • CVE-2012-1290Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter.

  • CVE-2012-1289Feb 23, 2012
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3)…

  • CVE-2011-4805Dec 14, 2011
    SAP
    Crystal Reports Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter.

  • CVE-2011-4707Dec 8, 2011
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.

  • CVE-2010-4556Dec 17, 2010
    SAP
    Netweaver Business Client For HTML
    risk 0.00cvss —epss 0.06

    Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2) LoadTheme methods.

  • CVE-2010-3983Oct 18, 2010
    SAP
    Businessobjects
    risk 0.00cvss —epss 0.02

    CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property.

  • CVE-2010-3982Oct 18, 2010
    SAP
    Businessobjects
    risk 0.00cvss —epss 0.01

    SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port, and obtain potentially sensitive information about open ports, via the apstoken parameter to the CrystalReports/viewrpt.cwr URI, related to an…

  • CVE-2010-3981Oct 18, 2010
    SAP
    Businessobjects
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the ServiceClass field to the Edit Service Parameters page.

  • CVE-2010-3980Oct 18, 2010
    SAP
    Businessobjects
    risk 0.00cvss —epss 0.01

    Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service via a large numCuids value in a GenerateCuids SOAPAction to the dswsbobje/services/biplatform URI.

  • CVE-2010-3979Oct 18, 2010
    SAP
    Businessobjects
    risk 0.00cvss —epss 0.01

    Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 generates different error messages depending on whether the Login field corresponds to a valid username, which allows remote attackers to enumerate account names via a login SOAPAction to the dswsbobje/services/session URI.

  • CVE-2010-2904Jul 28, 2010
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to…

  • CVE-2010-2347Jun 21, 2010
    SAP
    Server Core
    risk 0.00cvss —epss 0.01

    The Telnet interface in the SAP J2EE Engine Core (SAP-JEECOR) 6.40 through 7.02, and Server Core (SERVERCORE) 7.10 through 7.30 allows remote authenticated users to bypass a security check and conduct SMB relay attacks via unspecified vectors.

  • CVE-2010-1609Apr 29, 2010
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in SAP NetWeaver 2004 before SP21 and 2004s before SP13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4603Jan 12, 2010
    SAP
    Kernel
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in sapstartsrv.exe in the SAP Kernel 6.40, 7.00, 7.01, 7.10, 7.11, and 7.20, as used in SAP NetWeaver 7.x and SAP Web Application Server 6.x and 7.x, allows remote attackers to cause a denial of service (Management Console shutdown) via a crafted…

  • CVE-2009-3346Sep 24, 2009
    SAP
    Crystal Reports Server
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable…

  • CVE-2009-3345Sep 24, 2009
    SAP
    Crystal Reports Server
    risk 0.00cvss —epss 0.02

    Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable information. However, because the…

  • CVE-2009-3344Sep 24, 2009
    SAP
    Crystal Reports Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service (infinite loop) via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this…

  • CVE-2009-2932Aug 21, 2009
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field.

  • CVE-2008-3358Jan 28, 2009
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URI, which causes the XSS payload to be reflected in a text/plain…

  • CVE-2008-1810Aug 1, 2008
    SAP
    Maxdb
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable.

  • CVE-2008-1846Apr 16, 2008
    SAP
    Netweaver
    risk 0.00cvss —epss 0.01

    The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.

  • CVE-2008-0306Mar 11, 2008
    SAP
    Maxdb
    risk 0.00cvss —epss 0.00

    sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings.

  • CVE-2008-0307Mar 11, 2008
    SAP
    Maxdb
    risk 0.00cvss —epss 0.04

    Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption.

  • CVE-2008-0620Feb 6, 2008
    SAP
    Saplpd
    risk 0.00cvss —epss 0.03

    SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to cause a denial of service (crash) via a 0x53 LPD command, which causes the server to terminate.

  • CVE-2006-7220Jul 10, 2007
    SAP
    Saplpd
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SAP SAPLPD and SAPSPRINT allows remote attackers to cause a denial of service (application crash) via a certain print job request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-3615Jul 6, 2007
    SAP
    Internet Communication Manager
    risk 0.00cvss —epss 0.02

    Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to…

  • CVE-2007-3496Jun 29, 2007
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in SAP Web Dynpro Java (BC-WD-JAV) in SAP NetWeaver Nw04 SP15 through SP19 and Nw04s SP7 through SP11, aka SAP Java Technology Services 640 before SP20 and SAP Web Dynpro Runtime Core Components 700 before SP12, allows remote attackers to…

  • CVE-2007-3495Jun 29, 2007
    SAP
    Sap Basis Component 700
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the SAP Internet Communication Framework (BC-MID-ICF) in the SAP Basis component 700 before SP12, and 640 before SP20, allow remote attackers to inject arbitrary web script or HTML via certain parameters associated with the…

  • CVE-2007-1915Apr 10, 2007
    SAP
    Rfc Library
    risk 0.00cvss —epss 0.04

    Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the…

  • CVE-2007-1914Apr 10, 2007
    SAP
    Rfc Library
    risk 0.00cvss —epss 0.02

    The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is…

  • CVE-2007-1913Apr 10, 2007
    SAP
    Rfc Library
    risk 0.00cvss —epss 0.02

    The TRUSTED_SYSTEM_SECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is…

  • CVE-2007-1918Apr 10, 2007
    SAP
    Rfc Library
    risk 0.00cvss —epss 0.03

    The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server, which allows remote attackers to cause a denial of service (client lockout) via unspecified vectors. NOTE: This information…

  • CVE-2006-6345Dec 7, 2006
    SAP
    Internet Graphics Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 16 and earlier, and 7.00 Patchlevel 6 and earlier, allows remote attackers to delete arbitrary files via directory traversal sequences in an HTTP request. NOTE: This information is based…

  • CVE-2006-6346Dec 7, 2006
    SAP
    Internet Graphics Server
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows remote attackers to cause a denial of service (service shutdown), obtain sensitive information (configuration files), and conduct certain…

  • CVE-2006-6011Nov 21, 2006
    SAP
    Sap Web Application Server
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a different vulnerability than CVE-2006-5785.

  • CVE-2006-5785Nov 7, 2006
    SAP
    Sap Web Application Server
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service (enserver.exe crash) via a 0x72F2 sequence on UDP port 64999.

  • CVE-2006-4134Aug 14, 2006
    SAP
    Internet Graphics Server
    risk 0.00cvss —epss 0.05

    Unspecified vulnerability related to a "design flaw" in SAP Internet Graphics Service (IGS) 6.40 and earlier and 7.00 and earlier allows remote attackers to cause a denial of service (service shutdown) via certain HTTP requests. NOTE: This information is based upon a vague…

  • CVE-2006-2547May 23, 2006
    SAP
    Sapdba
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in the sapdba command in SAP with Informix before 700, and 700 up to patch 100, allows local users to execute arbitrary commands via unknown vectors related to "insecure environment variable" handling.

  • CVE-2006-0732Feb 16, 2006
    SAP
    Business Connector
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle. Details will be updated after the…

  • CVE-2005-4815Dec 31, 2005
    SAP
    Sap R 3
    risk 0.00cvss —epss 0.03

    SAP 6.4 before 6.40 patch 4, 6.2 before 6.20 patch 1364, 4.6 before 4.6D patch 1767, 45 before 45B patch 913, 40 before 40B patch 1008, and 31 before 31I patch 735 do not properly restrict process execution by lnaxdm/sapsys, which allows remote attackers to execute arbitrary…

  • CVE-2005-3633Nov 16, 2005
    SAP
    Sap Web Application Server
    risk 0.00cvss —epss 0.02

    HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.

  • CVE-2005-1691Jul 26, 2005
    SAP
    Internet Graphics Server
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Internet Graphics Server in SAP before 6.40 Patch 11 allows remote attackers to read arbitrary files via ".." sequences in an HTTP GET request.

  • CVE-2003-1034Apr 15, 2004
    SAP
    DB
    risk 0.00cvss —epss 0.00

    The RPM installation of SAP DB 7.x creates the (1) dbmsrv or (2) lserver programs with world-writable permissions, which allows local users to gain privileges by modifying those programs.

  • CVE-2002-1578Apr 15, 2004
    SAP
    R/3
    risk 0.00cvss —epss 0.03

    The default installation of SAP R/3, when using Oracle and SQL*net V2 3.x, 4.x, and 6.10, allows remote attackers to obtain arbitrary, sensitive SAP data by directly connecting to the Oracle database and executing queries against the database, which is not password-protected.

  • CVE-2002-1579Apr 15, 2004
    SAP
    Sapgui
    risk 0.00cvss —epss 0.02

    SAP GUI (Sapgui) 4.6D allows remote attackers to cause a denial of service (crash) via a connection to a high-numbered port, which generates an "unknown connection data" error.

  • CVE-2003-1038Apr 15, 2004
    SAP
    Internet Transaction Server
    risk 0.00cvss —epss 0.01

    The AGate component for SAP Internet Transaction Server (ITS) allows remote attackers to obtain sensitive information via a ~command parameter with an AgateInstallCheck value, which provides a list of installed DLLs and full pathnames.

  • CVE-2003-1035Apr 15, 2004
    SAP
    Sapgui
    risk 0.00cvss —epss 0.02

    The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.

  • CVE-2002-1577Apr 15, 2004
    SAP
    R/3
    risk 0.00cvss —epss 0.01

    SAP R/3 2.0B to 4.6D installs several clients with default users and passwords, which allows remote attackers to gain privileges via the (1) SAP*, (2) SAPCPIC, (3) DDIC, (4) EARLYWATCH, or (5) TMSADM accounts.

  • CVE-2003-1033Apr 15, 2004
    SAP
    DB
    risk 0.00cvss —epss 0.00

    The (1) instdbmsrv and (2) instlserver programs in SAP DB Development Tools 7.x trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program, which allows local users to gain root privileges via a modified INSTROOT that…

Page 39 of 40