NA
Product
Netweaver Application Server Abap
On CISA KEVExploited in the wild
86
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 18Medium 54Low 3
Watch
Add Netweaver Application Server Abap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-23858 | 6.1 | Feb 14 | Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated… Affected: 740; 750; 751; 752; 753; 754; +3 more |
| CVE-2023-23853 | 6.1 | Feb 14 | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can… Affected: 700; 702; 731; 740; 750; 751; +8 more |
| CVE-2023-0013 | 6.1 | Jan 10 | The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not… Affected: 702; 731; 740; 750; 751; 752; +5 more |
| CVE-2022-39799 | 6.1 | Sep 13 | An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack Affected: 7.54; 7.81; 7.85; 7.89; kernel_7.77 |
| CVE-2021-21490 | 6.1 | Jun 9 | SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in… Affected: 75a; 75f; 700; 702; 710; 711; +4 more |
| CVE-2020-26835 | 6.1 | Dec 9 | SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be… Affected: 740; 750; 751; 752; 753; 754 |
| CVE-2019-0321 | 6.1 | Jul 10 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability Affected: 7.31 |
| CVE-2024-41732 | 5.4 | Aug 13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls Affected: 755; 756; 757; 758; sap_basis_700; sap_basis_701; +4 more |
| CVE-2024-21738 | 5.4 | Jan 9 | SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with… Affected: 79; 700; 701; 702; 731; 740; +10 more |
| CVE-2023-40624 | 5.4 | Sep 12 | SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an… Affected: 702; 731; 754; 755; 756; 757; +1 more |
| CVE-2023-23854 | 5.4 | Feb 14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated… Affected: 700; 701; 702; 731; 740; 750; +2 more |
| CVE-2022-35294 | 5.4 | Sep 13 | An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other… Affected: 7.22ext; 7.49; 7.53; 7.54; 7.77; 7.81; +5 more |
| CVE-2022-29610 | 5.4 | May 11 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS)… Affected: 753; 754; 755; 756 |
| CVE-2022-26102 | 5.4 | Mar 10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start… Affected: 700; 701; 702; 731 |
| CVE-2021-33665 | 5.4 | Jun 9 | SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not… Affected: kernel_7.49; kernel_7.53; kernel_7.77; kernel_7.81; kernel_7.84; krnl64nuc_7.49; +2 more |
| CVE-2021-33664 | 5.4 | Jun 9 | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode… Affected: 31; 702; 750; 752; 753; 754; +1 more |
| CVE-2024-24740 | 5.3 | Feb 13 | SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain… Affected: kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; kernel_7.93; +2 more |
| CVE-2023-41366 | 5.3 | Nov 14 | Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92,… Affected: kernel_7.22; kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; +9 more |
| CVE-2021-40495 | 5.3 | Oct 12 | There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755 Affected: 740; 750; 751; 752; 753; 754; +1 more |
| CVE-2021-33684 | 5.3 | Jul 14 | SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,… Affected: 7.21; 7.21ext; 7.22; 7.22ext; 7.49; 7.53; +7 more |
| CVE-2021-33663 | 5.3 | Jun 9 | SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL -… Affected: kernel_7.22; kernel_7.49; kernel_7.53; kernel_7.73; kernel_7.77; kernel_7.81; +17 more |
| CVE-2026-27688 | 5.0 | Mar 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Affected: 700; 701; 702; 730; 731; 740; +10 more |
| CVE-2022-41212 | 4.9 | Nov 8 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to… Affected: 700; 731; 740; 750; 789; 804 |
| CVE-2021-40504 | 4.9 | Nov 10 | A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756,… Affected: 700; 701; 702; 710; 711; 730; +9 more |
| CVE-2022-41215 | 4.7 | Nov 8 | SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation Affected: 700; 731; 740; 750; 789 |
| CVE-2026-27680 | 4.3 | May 14 | CSS Injection vulnerability in SAP NetWeaver Application Server ABAP Affected: 758; 816 |
| CVE-2026-24310 | 4.3 | Mar 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Affected: 702; 731; 740; 750; 751; 752; +7 more |
| CVE-2024-41734 | 4.3 | Aug 13 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to… Affected: sap_basis_700; sap_basis_701; sap_basis_702; sap_basis_731; sap_basis_740; sap_basis_750; +9 more |
| CVE-2021-42067 | 4.3 | Jan 14 | In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use… Affected: 701; 702; 711; 730; 731; 740; +8 more |
| CVE-2021-40496 | 4.3 | Oct 12 | SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon functionality, to exploit… Affected: 700; 701; 702; 730; 731; 740; +8 more |
| CVE-2020-6371 | 4.3 | Oct 15 | User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP (POWL test… Affected: 710; 711; 730; 731; 740; 750 |
| CVE-2020-6310 | 4.3 | Aug 12 | Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to… Affected: 700; 701; 702; 710; 711; 731; +5 more |
| CVE-2020-6299 | 4.3 | Aug 12 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value… Affected: 740; 750; 751; 753; 754; 755 |
| CVE-2024-41728 | 2.7 | Sep 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform Affected: 700; 701; 702; 731; 740; 750; +9 more |
| CVE-2024-44114 | 2.7 | Sep 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform Affected: 702; 731; 740; 750; 751; 752; +7 more |
| CVE-2020-6280 | 2.7 | Jul 14 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted,… Affected: 731; 740; 750 |