NE
Product
NetWeaver
On CISA KEVExploited in the wildRansomware-linked
109
CVEs
10
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 21Medium 27Low 2
Watch
Add NetWeaver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-38163 In wildKEV | 8.8 | Sep 14 | SAP NetWeaver Unrestricted File Upload Vulnerability Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2017-12637 In wildKEV | 7.5 | Aug 7 | SAP NetWeaver Directory Traversal Vulnerability Affected: All versions, or not specified |
| CVE-2016-3976 In wildKEV | 7.5 | Apr 7 | SAP NetWeaver Directory Traversal Vulnerability Affected: All versions, or not specified |
| CVE-2023-36922 | 8.8 | Jul 11 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system… Affected: 600; 602; 603; 604; 605; 606; +9 more |
| CVE-2021-21481 | 8.8 | Mar 9 | The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2019-0351 | 8.8 | Aug 14 | A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2018-2477 | 8.8 | Nov 13 | Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2018-2462 | 8.8 | Sep 11 | In certain cases, BEx Web Java Runtime Export Web Service in SAP NetWeaver BI 7.30, 7.31 Affected: 7.30; 7.31; 7.40; 7.41; 7.50 |
| CVE-2018-2363 | 8.8 | Jan 9 | SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's… Affected: All versions, or not specified |
| CVE-2016-4014 | 8.6 | Apr 14 | XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in… Affected: 7.4 |
| CVE-2024-22124 | 7.5 | Jan 9 | Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC… Affected: kernel_7.22; kernel_7.53; kernel_7.54; krnl64nuc_7.22; krnl64nuc_7.22ext; krnl64uc_7.22ext; +4 more |
| CVE-2022-28773 | 7.5 | Apr 12 | Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted… Affected: 7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; +4 more |
| CVE-2022-28772 | 7.5 | Apr 12 | By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication… Affected: 7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; +4 more |
| CVE-2013-1593 | 7.5 | Jan 23 | A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP… Affected: 7.01; 7.02; 7.30; 2004s |
| CVE-2017-9845 | 7.5 | Jul 12 | disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note… Affected: 7.40 |
| CVE-2017-9844 | 7.5 | Jul 12 | SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to… Affected: 7400.12.21.30308 |
| CVE-2017-5372 | 7.5 | Jan 23 | The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing… Affected: All versions, or not specified |
| CVE-2016-3635 | 7.5 | Oct 13 | SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by… Affected: 7.40 |
| CVE-2016-4551 | 7.5 | Oct 5 | The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via… Affected: 2004s |
| CVE-2016-4015 | 7.5 | Apr 14 | The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request, aka SAP Security Note… Affected: 7.1; 7.2; 7.3; 7.4 |
| CVE-2016-2389 | 7.5 | Feb 16 | Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote… Affected: 7.40 |
Showing 21