NE
Product
NetWeaver
On CISA KEVExploited in the wildRansomware-linked
109
CVEs
10
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 21Medium 27Low 2
Watch
Add NetWeaver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9563 In wildKEV | 6.5 | Nov 23 | SAP NetWeaver XML External Entity (XXE) Vulnerability Affected: All versions, or not specified |
| CVE-2016-2388 In wildKEV | 5.3 | Feb 16 | SAP NetWeaver Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2023-29186 | 6.5 | Apr 11 | In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server Affected: 707; 737; 747; 757 |
| CVE-2022-28217 | 6.5 | Jun 13 | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit… Affected: 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-6285 | 6.5 | Jul 14 | SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access information which… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2023-33985 | 6.1 | Jun 13 | SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS)… Affected: 7.50 |
| CVE-2023-27499 | 6.1 | Apr 11 | SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled… Affected: 7.22ext |
| CVE-2023-0021 | 6.1 | Mar 14 | Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data… Affected: 700; 701; 702; 731; 740; 750 |
| CVE-2022-22534 | 6.1 | Feb 9 | Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password Affected: 700; 701; 702; 731; 740; 750; +6 more |
| CVE-2021-38183 | 6.1 | Oct 12 | SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to… Affected: 700; 701; 702; 730 |
| CVE-2020-6184 | 6.1 | Feb 12 | Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently… Affected: 7.40 |
| CVE-2018-2476 | 6.1 | Nov 13 | Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site Affected: 7.30; 7.31; 7.40 |
| CVE-2018-2470 | 6.1 | Oct 9 | In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting… Affected: 7.0 through 7.02; 7.50 through 7.53; 7.30; 7.31; 7.40 |
| CVE-2018-2464 | 6.1 | Sep 11 | SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability Affected: 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2016-2387 | 6.1 | Feb 16 | Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or… Affected: 7.40 |
| CVE-2016-1911 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime… Affected: 7.40 |
| CVE-2019-0248 | 5.9 | Jan 8 | Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would… Affected: 7.5; 7.51; 7.52; 7.53 |
| CVE-2020-6181 | 5.8 | Feb 12 | Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753,… Affected: 7.02; 7.30; 7.31; 7.40 |
| CVE-2023-33984 | 5.4 | Jun 13 | SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with… Affected: 7.50 |
| CVE-2020-6185 | 5.4 | Feb 12 | Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated… Affected: 7.40 |
| CVE-2024-27898 | 5.3 | Apr 9 | SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind… Affected: 7.5 |
| CVE-2024-25644 | 5.3 | Mar 12 | Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality… Affected: 7.50 |
| CVE-2023-41367 | 5.3 | Sep 12 | Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific… Affected: 7.50 |
| CVE-2016-1910 | 5.3 | Jan 15 | The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290 Affected: 7.40 |
| CVE-2026-23685 | 4.4 | Feb 10 | Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) Affected: 7.50 |
| CVE-2025-42968 | 4.3 | Jul 8 | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP… Affected: 700; 701; 702; 710; 731; 740; +12 more |
| CVE-2018-2434 | 4.3 | Jul 10 | A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP… Affected: 7.0 |
Showing 27