NE
Product
NetWeaver
On CISA KEVExploited in the wildRansomware-linked
109
CVEs
10
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 21Medium 27Low 2
Watch
Add NetWeaver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6287 In wildKEV | 10.0 | Jul 14 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability Affected: All versions, or not specified |
| CVE-2010-5326 In wildKEV | 10.0 | May 13 | SAP NetWeaver Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2025-31324 RansomwareIn wildKEV | 9.8 | Apr 24 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) Affected: 7.50 |
| CVE-2016-2386 In wildKEV | 9.8 | Feb 16 | SAP NetWeaver SQL Injection Vulnerability Affected: All versions, or not specified |
| CVE-2025-42999 RansomwareIn wildKEV | 9.1 | May 13 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) Affected: 7.5 |
| CVE-2021-38163 In wildKEV | 8.8 | Sep 14 | SAP NetWeaver Unrestricted File Upload Vulnerability Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2017-12637 In wildKEV | 7.5 | Aug 7 | SAP NetWeaver Directory Traversal Vulnerability Affected: All versions, or not specified |
| CVE-2016-3976 In wildKEV | 7.5 | Apr 7 | SAP NetWeaver Directory Traversal Vulnerability Affected: All versions, or not specified |
| CVE-2016-9563 In wildKEV | 6.5 | Nov 23 | SAP NetWeaver XML External Entity (XXE) Vulnerability Affected: All versions, or not specified |
| CVE-2016-2388 In wildKEV | 5.3 | Feb 16 | SAP NetWeaver Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2011-1517 | 9.8 | Feb 5 | SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function Affected: 7.0 |
| CVE-2013-1592 | 9.8 | Jan 23 | A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports… Affected: 7.01; 7.02; 7.30; 2004s |
| CVE-2015-7241 | 9.8 | Sep 6 | XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01 Affected: through 7.0 |
| CVE-2016-10311 | 9.8 | Apr 10 | Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by sending a crafted packet to the SAPSTARTSRV port, aka SAP… Affected: 7.0; 7.0; 7.0; 7.0; 7.3; 7.3; +2 more |
| CVE-2020-6203 | 9.1 | Mar 10 | SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2016-7435 | 9.1 | Oct 5 | The (1) SCTC_REFRESH_EXPORT_TAB_COMP, (2) SCTC_REFRESH_CHECK_ENV, and (3) SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote… Affected: 7.40 |
| CVE-2023-36922 | 8.8 | Jul 11 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system… Affected: 600; 602; 603; 604; 605; 606; +9 more |
| CVE-2021-21481 | 8.8 | Mar 9 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2019-0351 | 8.8 | Aug 14 | A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2018-2477 | 8.8 | Nov 13 | Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2018-2462 | 8.8 | Sep 11 | In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31 Affected: 7.30; 7.31; 7.40; 7.41; 7.50 |
| CVE-2018-2363 | 8.8 | Jan 9 | SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's… Affected: All versions, or not specified |
| CVE-2016-4014 | 8.6 | Apr 14 | XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in… Affected: 7.4 |
| CVE-2024-22124 | 7.5 | Jan 9 | Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC… Affected: kernel_7.22; kernel_7.53; kernel_7.54; krnl64nuc_7.22; krnl64nuc_7.22ext; krnl64uc_7.22ext; +4 more |
| CVE-2022-28773 | 7.5 | Apr 12 | Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted… Affected: 7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; +4 more |
| CVE-2022-28772 | 7.5 | Apr 12 | By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication… Affected: 7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; +4 more |
| CVE-2013-1593 | 7.5 | Jan 23 | A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP… Affected: 7.01; 7.02; 7.30; 2004s |
| CVE-2017-9845 | 7.5 | Jul 12 | disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note… Affected: 7.40 |
| CVE-2017-9844 | 7.5 | Jul 12 | SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to… Affected: 7400.12.21.30308 |
| CVE-2017-5372 | 7.5 | Jan 23 | The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing… Affected: All versions, or not specified |
| CVE-2016-3635 | 7.5 | Oct 13 | SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by… Affected: 7.40 |
| CVE-2016-4551 | 7.5 | Oct 5 | The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via… Affected: 2004s |
| CVE-2016-4015 | 7.5 | Apr 14 | The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request, aka SAP Security Note… Affected: 7.1; 7.2; 7.3; 7.4 |
| CVE-2016-2389 | 7.5 | Feb 16 | Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote… Affected: 7.40 |
| CVE-2023-29186 | 6.5 | Apr 11 | In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server Affected: 707; 737; 747; 757 |
| CVE-2022-28217 | 6.5 | Jun 13 | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit… Affected: 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-6285 | 6.5 | Jul 14 | SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access information which… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2023-33985 | 6.1 | Jun 13 | SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS)… Affected: 7.50 |
| CVE-2023-27499 | 6.1 | Apr 11 | SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled… Affected: 7.22ext |
| CVE-2023-0021 | 6.1 | Mar 14 | Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data… Affected: 700; 701; 702; 731; 740; 750 |
| CVE-2022-22534 | 6.1 | Feb 9 | Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password Affected: 700; 701; 702; 731; 740; 750; +6 more |
| CVE-2021-38183 | 6.1 | Oct 12 | SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to… Affected: 700; 701; 702; 730 |
| CVE-2020-6184 | 6.1 | Feb 12 | Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently… Affected: 7.40 |
| CVE-2018-2476 | 6.1 | Nov 13 | Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site Affected: 7.30; 7.31; 7.40 |
| CVE-2018-2470 | 6.1 | Oct 9 | In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting… Affected: 7.0 through 7.02; 7.50 through 7.53; 7.30; 7.31; 7.40 |
| CVE-2018-2464 | 6.1 | Sep 11 | SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability Affected: 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2016-2387 | 6.1 | Feb 16 | Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or… Affected: 7.40 |
| CVE-2016-1911 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime… Affected: 7.40 |
| CVE-2019-0248 | 5.9 | Jan 8 | Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would… Affected: 7.5; 7.51; 7.52; 7.53 |
| CVE-2020-6181 | 5.8 | Feb 12 | Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753,… Affected: 7.02; 7.30; 7.31; 7.40 |