Netweaver_application_server_java

Repositories	Unknown: This might be proprietary software.
#Vulnerabilities	66

Date	Id	Summary	Products	Score
2024-02-13	CVE-2024-22126	The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.	Netweaver_application_server_java	6.1
2016-05-13	CVE-2010-5326	The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.	Netweaver_application_server_java	10.0
2016-11-23	CVE-2016-9563	BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.	Netweaver_application_server_java	6.5
2024-03-12	CVE-2024-22127	SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.	Netweaver_application_server_java	9.1