NA
Product
Netweaver Application Server Java
On CISA KEVExploited in the wild
69
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 20Medium 37Low 1
Watch
Add Netweaver Application Server Java to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6287 In wildKEV | 10.0 | Jul 14 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2010-5326 In wildKEV | 10.0 | May 13 | SAP NetWeaver Remote Code Execution Vulnerability Affected: through 7.30 |
| CVE-2016-2386 In wildKEV | 9.8 | Feb 16 | SAP NetWeaver SQL Injection Vulnerability Affected: 7.40 |
| CVE-2017-12637 In wildKEV | 7.5 | Aug 7 | SAP NetWeaver Directory Traversal Vulnerability Affected: 7.50 |
| CVE-2016-3976 In wildKEV | 7.5 | Apr 7 | SAP NetWeaver Directory Traversal Vulnerability Affected: 7.10 through 7.50 |
| CVE-2016-9563 In wildKEV | 6.5 | Nov 23 | SAP NetWeaver XML External Entity (XXE) Vulnerability Affected: 7.50 |
| CVE-2016-2388 In wildKEV | 5.3 | Feb 16 | SAP NetWeaver Information Disclosure Vulnerability Affected: 7.10 through 7.50 |
| CVE-2020-26829 | 10.0 | Dec 9 | SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication… Affected: 7.11; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2023-40309 | 9.8 | Sep 12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation… Affected: kernel_7.22; kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; +10 more |
| CVE-2022-22532 | 9.8 | Feb 9 | In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could… Affected: 7.22; 7.49; 7.53; krnl64nuc_7.22; krnl64nuc_7.22ext; krnl64nuc_7.49; +3 more |
| CVE-2021-37535 | 9.8 | Sep 14 | SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for user privileges Affected: 7.11; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-6263 | 9.8 | Jun 10 | Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01,… Affected: 7.00; 7.01; 7.02; 7.05; 7.10; 7.11; +5 more |
| CVE-2019-0345 | 9.8 | Aug 14 | A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2024-22127 | 9.1 | Mar 12 | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to… Affected: 7.5 |
| CVE-2016-3974 | 9.1 | Apr 7 | XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB… Affected: 7.10 through 7.50 |
| CVE-2019-0389 | 8.8 | Nov 13 | An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for all or some functions… Affected: 7.1; 7.2; 7.3; 7.4; 7.5; 7.31 |
| CVE-2017-8913 | 8.8 | May 23 | The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in… Affected: 7.50 |
| CVE-2017-7717 | 8.8 | Apr 14 | SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL… Affected: 7.40 |
| CVE-2015-8840 | 8.8 | Apr 8 | The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain… Affected: All versions, or not specified |
| CVE-2024-34688 | 7.5 | Jun 11 | Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users… Affected: mmr_server_7.5 |
| CVE-2024-24743 | 7.5 | Feb 13 | SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which… Affected: 7.50 |
| CVE-2023-40308 | 7.5 | Sep 12 | SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes… Affected: kernel_7.22; kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; +10 more |
| CVE-2022-22533 | 7.5 | Feb 9 | Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an… Affected: 7.22; 7.49; 7.53; krnl64nuc_7.22; krnl64nuc_7.22ext; krnl64nuc_7.49; +3 more |
| CVE-2021-33670 | 7.5 | Jul 14 | SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2020-6309 | 7.5 | Aug 12 | SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2017-14581 | 7.5 | Sep 19 | The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security… Affected: 7.00 through 7.50 |
| CVE-2016-9562 | 7.5 | Nov 23 | SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the… Affected: 7.40 |
| CVE-2018-2503 | 7.4 | Dec 11 | By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected Affected: 7.11; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-26820 | 7.2 | Nov 10 | SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose… Affected: 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-6202 | 7.2 | Mar 10 | SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2019-0355 | 7.2 | Sep 10 | SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2019-0327 | 7.2 | Jul 10 | SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2018-2492 | 7.1 | Dec 11 | SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source Affected: 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2023-42477 | 6.5 | Oct 10 | SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on… Affected: 7.50 |
| CVE-2021-21485 | 6.5 | Apr 13 | An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-26826 | 6.5 | Dec 9 | Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without proper file format… Affected: 7.31; 7.40; 7.50 |
| CVE-2020-6313 | 6.5 | Sep 9 | SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2017-11457 | 6.5 | Jul 25 | XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request… Affected: 7.50 |
| CVE-2016-10304 | 6.5 | Apr 10 | The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a… Affected: 7.50 |
| CVE-2020-6224 | 6.2 | Apr 14 | SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2026-27674 | 6.1 | Apr 14 | Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) Affected: 7.50 |
| CVE-2024-22126 | 6.1 | Feb 13 | The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the… Affected: 7.50 |
| CVE-2022-41262 | 6.1 | Dec 12 | Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into a web request header Affected: 7.50 |
| CVE-2021-21491 | 6.1 | Mar 10 | SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a… Affected: 7.00; 7.10; 7.11; 7.20; 7.30; 7.31; +2 more |
| CVE-2020-6365 | 6.1 | Oct 15 | SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2020-6319 | 6.1 | Oct 15 | SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2018-2504 | 6.1 | Dec 11 | SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2018-2452 | 6.1 | Sep 11 | The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2017-11458 | 6.1 | Jul 25 | Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 7.30 |
| CVE-2016-3975 | 6.1 | Apr 7 | Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter… Affected: 7.10 through 7.50 |