NA
Product
Netweaver Application Server Java
On CISA KEVExploited in the wild
69
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 20Medium 37Low 1
Watch
Add Netweaver Application Server Java to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9563 In wildKEV | 6.5 | Nov 23 | SAP NetWeaver XML External Entity (XXE) Vulnerability Affected: 7.50 |
| CVE-2016-2388 In wildKEV | 5.3 | Feb 16 | SAP NetWeaver Information Disclosure Vulnerability Affected: 7.10 through 7.50 |
| CVE-2023-42477 | 6.5 | Oct 10 | SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on… Affected: 7.50 |
| CVE-2021-21485 | 6.5 | Apr 13 | An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the attacker to gain NTLM… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-26826 | 6.5 | Dec 9 | Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without proper file format… Affected: 7.31; 7.40; 7.50 |
| CVE-2020-6313 | 6.5 | Sep 9 | SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2017-11457 | 6.5 | Jul 25 | XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request… Affected: 7.50 |
| CVE-2016-10304 | 6.5 | Apr 10 | The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a… Affected: 7.50 |
| CVE-2020-6224 | 6.2 | Apr 14 | SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2026-27674 | 6.1 | Apr 14 | Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) Affected: 7.50 |
| CVE-2024-22126 | 6.1 | Feb 13 | The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the… Affected: 7.50 |
| CVE-2022-41262 | 6.1 | Dec 12 | Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into a web request header Affected: 7.50 |
| CVE-2021-21491 | 6.1 | Mar 10 | SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to redirect users to a… Affected: 7.00; 7.10; 7.11; 7.20; 7.30; 7.31; +2 more |
| CVE-2020-6365 | 6.1 | Oct 15 | SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2020-6319 | 6.1 | Oct 15 | SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2018-2504 | 6.1 | Dec 11 | SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2018-2452 | 6.1 | Sep 11 | The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2017-11458 | 6.1 | Jul 25 | Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 7.30 |
| CVE-2016-3975 | 6.1 | Apr 7 | Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter… Affected: 7.10 through 7.50 |
| CVE-2020-6282 | 5.8 | Jul 14 | SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11,… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2020-6190 | 5.8 | Feb 12 | Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2021-27601 | 5.4 | Apr 13 | SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server Affected: 7.10; 7.11; 7.30; 7.31; 7.40; 7.50 |
| CVE-2019-0275 | 5.4 | Mar 12 | SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode… Affected: 7.10 through 7.11; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2025-42926 | 5.3 | Sep 9 | SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully… Affected: 7.50 |
| CVE-2024-28164 | 5.3 | Jun 11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low… Affected: gp-core_7.5 |
| CVE-2023-42480 | 5.3 | Nov 14 | The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an… Affected: 7.50 |
| CVE-2023-24526 | 5.3 | Mar 14 | SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in… Affected: 7.50 |
| CVE-2022-26103 | 5.3 | Mar 10 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to information gathering for… Affected: 7.50 |
| CVE-2021-27598 | 5.3 | Apr 13 | SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp… Affected: 7.31; 7.40; 7.50 |
| CVE-2020-6286 | 5.3 | Jul 14 | The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2019-0318 | 5.3 | Jul 10 | Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which… Affected: 7.21; 7.22; 7.45; 7.49; 7.53 |
| CVE-2016-3973 | 5.3 | Apr 7 | The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by… Affected: 7.10 through 7.50 |
| CVE-2021-33687 | 4.9 | Jul 14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-26816 | 4.5 | Dec 9 | SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2021-33689 | 4.3 | Jul 14 | When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security audit log is… Affected: 7.50 |
| CVE-2021-21492 | 4.3 | Apr 13 | SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2019-0391 | 4.3 | Nov 13 | Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
Showing 37