Skip to contentSap Application Server vulnerabilities
- sap netweaver, netweaver application server java +1 moreDirectory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP...CVE-2017-12637In KEVPublic exploitEPSS 95.1%7.5 High
- sap netweaver application server javaCross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS...CVE-2017-114586.1 Medium
- sap netweaver application server javaXML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows...CVE-2017-114576.5 Medium
- sap netweaver application server javaThe Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote...CVE-2017-89138.8 High
- sap netweaver application server javaSQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP...CVE-2017-77178.8 High
- sap netweaver application server javaThe SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to...CVE-2016-103046.5 Medium
- sap netweaver, netweaver application server java +1 moreBC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML...CVE-2016-9563In KEVEPSS 24.2%6.5 Medium
- sap netweaver application server javaSAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer...CVE-2016-95627.5 High
- sap netweaver, netweaver application server java +1 moreThe Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does...CVE-2010-5326In KEVEPSS 17.8%10.0 Critical
- sap application server javaThe Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to...CVE-2016-39807.5 High
- sap netweaver application server javaThe XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization,...CVE-2015-88408.8 High
- sap netweaver, netweaver application server java +1 moreDirectory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote...CVE-2016-3976In KEVPublic exploitEPSS 47.3%7.5 High
- sap netweaver application server javaCross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote...CVE-2016-39756.1 Medium
- sap netweaver application server javaXML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1...CVE-2016-3974Public exploitEPSS 14.4%9.1 Critical
- sap netweaver application server javaThe chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java...CVE-2016-39735.3 Medium
- sap netweaver, netweaver application server java +1 moreThe Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to...CVE-2016-2388In KEVPublic exploitEPSS 52.2%5.3 Medium
- sap netweaver, netweaver application server java +1 moreSQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote...CVE-2016-2386In KEVPublic exploitEPSS 71.5%9.8 Critical
- sap netweaver abap application server, netweaver java application server +1 moreSAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination)...CVE-2015-41585.0 Medium
- sap gui, maxdb, netweaver rfc sdk +3 more +5 moreStack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC...CVE-2015-22827.5 High
- sap gui, maxdb, netweaver rfc sdk +3 more +5 moreThe LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in...CVE-2015-22785.0 Medium
- sap netweaver application server javaXML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to...CVE-2015-40917.5 High
- sap netweaver java application serverXML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application...CVE-2014-85904.3 Medium
- sap netweaver java application serverSAP Netweaver Java Application Server does not properly restrict access, which allows remote...CVE-2014-31335.0 Medium
- sap netweaver abap application serverThe ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP...CVE-2014-31304.6 Medium
- sap web application server, web dynpro +1 moreCross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0,...CVE-2008-2421Public exploit4.3 Medium
- sap internet communication manager, web application server +1 moreInternet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and...CVE-2007-36157.8 High
- sap web application serverUnspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote...CVE-2006-60115.0 Medium
- sap web application serverSAP allows remote attackers to obtain potentially sensitive information such as operating system...CVE-2006-6010EPSS 14.3%5.0 Medium
- sap web application serverUnspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before...CVE-2006-57855.0 Medium
- sap web application serverUnspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and...CVE-2006-5784Public exploit4.6 Medium
- sap web application serverSAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary...CVE-2006-1039Public exploit6.4 Medium
- sap web application serverCross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote...CVE-2005-3636Public exploit4.3 Medium
- sap web application serverMultiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10...CVE-2005-3635Public exploit4.3 Medium
- sap web application serverframeset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows...CVE-2005-3634Public exploitEPSS 17.8%5.0 Medium
- sap web application serverHTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10...CVE-2005-36335.0 Medium
- sap saposcol, r 3 web application server demo +1 moresaposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable...CVE-2001-03667.2 High