| CVE-2014-6252 |
medium |
— |
6.5 |
|
|
sap |
12y ago |
Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbi… |
| CVE-2014-5506 |
medium |
— |
6.8 |
|
|
sap |
12y ago |
Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file. |
| CVE-2014-5505 |
medium |
— |
6.8 |
|
|
sap |
12y ago |
Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file. |
| CVE-2014-5176 |
medium |
— |
6.0 |
|
|
sap |
12y ago |
SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-5175 |
high |
— |
7.5 |
|
|
sap |
12y ago |
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS. |
| CVE-2014-5174 |
low |
— |
3.5 |
|
|
sap |
12y ago |
The SAP Netweaver Business Warehouse component does not properly restrict access to the functions in the BW-SYS-DB-DB4 function group, which allows remote authenticated users to obtain sensitive info… |
| CVE-2014-5173 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public. |
| CVE-2014-5172 |
medium |
— |
4.3 |
|
|
sap |
12y ago |
Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-5171 |
low |
— |
2.9 |
|
|
sap |
12y ago |
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and othe… |
| CVE-2014-4161 |
medium |
— |
4.3 |
|
|
sap |
12y ago |
Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter. |
| CVE-2014-4160 |
medium |
— |
4.3 |
|
|
sap |
12y ago |
Multiple cross-site scripting (XSS) vulnerabilities in the testcanvas node in SAP NetWeaver Business Client (NWBC) allow remote attackers to inject arbitrary web script or HTML via the (1) title or (… |
| CVE-2014-4159 |
medium |
— |
5.8 |
|
|
sap |
12y ago |
Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a … |
| CVE-2014-4012 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4011 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4010 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4009 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4008 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4007 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
The SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4006 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
The SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4005 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4004 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
The (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-4003 |
high |
— |
7.5 |
|
|
sap |
12y ago |
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system. |
| CVE-2014-3787 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors. |
| CVE-2014-3134 |
medium |
— |
4.3 |
|
|
sap |
12y ago |
Cross-site scripting (XSS) vulnerability in the InfoView application in SAP BusinessObjects allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-3133 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
SAP Netweaver Java Application Server does not properly restrict access, which allows remote attackers to obtain the list of SAP systems registered on an SLD via an unspecified webdynpro, related to … |
| CVE-2014-3132 |
medium |
— |
4.0 |
|
|
sap |
12y ago |
SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7… |
| CVE-2014-3131 |
medium |
— |
4.0 |
|
|
sap |
12y ago |
SAP Profile Maintenance does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. |
| CVE-2014-3130 |
medium |
— |
4.6 |
|
|
sap |
12y ago |
The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and exe… |
| CVE-2014-3129 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. |
| CVE-2014-0984 |
medium |
— |
5.3 |
EXP |
|
sap |
12y ago |
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrec… |
| CVE-2014-2752 |
high |
— |
7.5 |
|
|
sap |
12y ago |
SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-2751 |
high |
— |
7.5 |
|
|
sap |
12y ago |
SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. |
| CVE-2014-2749 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request. |
| CVE-2014-2748 |
high |
— |
7.5 |
|
|
sap |
12y ago |
The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors. NOTE: some of these deta… |
| CVE-2013-7367 |
high |
— |
7.5 |
|
|
sap |
12y ago |
SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, which allows remote attackers to gain privileges via unspecified vectors. |
| CVE-2013-7366 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications. |
| CVE-2013-7365 |
medium |
— |
4.3 |
|
|
sap |
12y ago |
Cross-site scripting (XSS) vulnerability in SAP Enterprise Portal allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. |
| CVE-2013-7364 |
high |
— |
7.5 |
|
|
sap |
12y ago |
An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via unknown vectors. |
| CVE-2013-7363 |
high |
— |
7.5 |
|
|
sap |
12y ago |
Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the configuration of applications, and install or remo… |
| CVE-2013-7362 |
high |
— |
7.5 |
|
|
sap |
12y ago |
An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors. |
| CVE-2013-7361 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
Directory traversal vulnerability in SAP CMS and CM Services allows attackers to upload arbitrary files via unspecified vectors. |
| CVE-2013-7360 |
high |
— |
7.5 |
|
|
sap |
12y ago |
Unspecified vulnerability in SAP adminadapter allows remote attackers to read or write to arbitrary files via unknown vectors. |
| CVE-2013-7359 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
Unspecified vulnerability in SAP Mobile Infrastructure allows remote attackers to obtain sensitive port information via unknown vectors, related to an "internal port scanning" issue. |
| CVE-2013-7358 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
Unspecified vulnerability in SAP Guided Procedures Archive Monitor allows remote attackers to obtain usernames, roles, profiles, and possibly other identity information via unknown vectors. |
| CVE-2013-7357 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
Unspecified vulnerability in the configuration service in SAP J2EE Engine allows remote attackers to obtain credential information via unknown vectors. |
| CVE-2013-7356 |
medium |
— |
5.0 |
|
|
sap |
12y ago |
Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors. |
| CVE-2013-7355 |
high |
— |
7.5 |
|
|
sap |
12y ago |
SQL injection vulnerability in SAP BI Universal Data Integration allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to the J2EE schema. |
| CVE-2014-1965 |
medium |
— |
4.3 |
|
|
sap |
13y ago |
Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetW… |
| CVE-2014-1964 |
medium |
— |
4.3 |
|
|
sap |
13y ago |
Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject arbitrary web script or … |
| CVE-2014-1963 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors. |
| CVE-2014-1962 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue. |
| CVE-2014-1961 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors. |
| CVE-2014-1960 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2013-7096 |
high |
— |
7.5 |
|
|
sap |
13y ago |
Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2013-7095 |
critical |
— |
10.0 |
|
|
sap |
13y ago |
The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue. |
| CVE-2013-7094 |
high |
— |
7.5 |
|
|
sap |
13y ago |
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2013-7093 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors. |
| CVE-2013-6869 |
high |
— |
7.5 |
|
|
sap |
13y ago |
SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2013-6823 |
medium |
— |
6.4 |
|
|
sap |
13y ago |
GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors. |
| CVE-2013-6822 |
critical |
— |
10.0 |
|
|
sap |
13y ago |
GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue. |
| CVE-2013-6821 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2013-6820 |
critical |
— |
9.3 |
|
|
sap |
13y ago |
Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via un… |
| CVE-2013-6819 |
medium |
— |
4.3 |
|
|
sap |
13y ago |
Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2013-6818 |
medium |
— |
6.4 |
|
|
sap |
13y ago |
SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vectors. |
| CVE-2013-6817 |
medium |
— |
6.8 |
|
|
sap |
13y ago |
Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages. |
| CVE-2013-6816 |
medium |
— |
4.3 |
|
|
sap |
13y ago |
Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspec… |
| CVE-2013-6815 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to a… |
| CVE-2013-6814 |
medium |
— |
5.8 |
|
|
sap |
13y ago |
The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPP… |
| CVE-2013-3243 |
medium |
— |
6.8 |
|
|
opentextsap |
13y ago |
Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors. |
| CVE-2013-6284 |
high |
— |
7.5 |
|
|
sap |
13y ago |
Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Component (ECC) allows attackers to execute arbitrary code vi… |
| CVE-2013-6244 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML doc… |
| CVE-2013-3244 |
medium |
— |
6.0 |
|
|
sap |
13y ago |
Multiple unspecified vulnerabilities in the CJDB_FILL_MEMORY_FROM_PPB function in the Project System (PS-IS) module for SAP ERP Central Component (ECC) allow remote attackers to execute arbitrary cod… |
| CVE-2013-5751 |
medium |
— |
5.0 |
|
|
sap |
13y ago |
Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2013-5723 |
high |
— |
7.5 |
|
|
sap |
13y ago |
SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0_DELETE_DERIVATION_TABLE." |
| CVE-2013-3319 |
medium |
— |
6.0 |
EXP |
|
sap |
13y ago |
The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128. |
| CVE-2013-3063 |
medium |
— |
6.0 |
|
|
sap |
13y ago |
SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors. |
| CVE-2013-3062 |
medium |
— |
6.5 |
|
|
sap |
13y ago |
The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authenticated users to bypass intended transaction restrictions … |
| CVE-2013-3061 |
medium |
— |
6.5 |
|
|
sap |
13y ago |
The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remot… |
| CVE-2011-5263 |
medium |
— |
4.3 |
|
|
sap |
14y ago |
Cross-site scripting (XSS) vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server parameter. |
| CVE-2011-5260 |
medium |
— |
4.3 |
|
|
sap |
14y ago |
Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter. |
| CVE-2011-5154 |
medium |
— |
6.9 |
|
|
sap |
14y ago |
Multiple untrusted search path vulnerabilities in (1) SAPGui.exe and (2) BExAnalyzer.exe in SAP GUI 6.4 through 7.2 allow local users to gain privileges via a Trojan horse MFC80LOC.DLL file in the cu… |
| CVE-2012-4341 |
critical |
— |
10.0 |
|
|
sap |
14y ago |
Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value… |
| CVE-2012-2612 |
medium |
— |
6.0 |
EXP |
|
sap |
14y ago |
The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon cras… |
| CVE-2012-2611 |
critical |
— |
10.0 |
EXP |
|
sap |
14y ago |
The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace config… |
| CVE-2012-2514 |
medium |
— |
6.0 |
EXP |
|
sap |
14y ago |
The DiagiEventSource function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon … |
| CVE-2012-2513 |
medium |
— |
6.0 |
EXP |
|
sap |
14y ago |
The Diaginput function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) … |
| CVE-2012-2512 |
medium |
— |
6.0 |
EXP |
|
sap |
14y ago |
The DiagTraceStreamI function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon … |
| CVE-2012-2511 |
medium |
— |
6.0 |
EXP |
|
sap |
14y ago |
The DiagTraceAtoms function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon cr… |
| CVE-2012-1292 |
medium |
— |
5.0 |
|
|
sap |
15y ago |
Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vector… |
| CVE-2012-1291 |
medium |
— |
5.0 |
|
|
sap |
15y ago |
Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecifie… |
| CVE-2012-1290 |
medium |
— |
4.3 |
|
|
sap |
15y ago |
Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via th… |
| CVE-2012-1289 |
medium |
— |
4.0 |
|
|
sap |
15y ago |
Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or … |
| CVE-2011-4805 |
medium |
— |
4.3 |
|
|
sap |
15y ago |
Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter. |
| CVE-2011-4707 |
medium |
— |
4.3 |
|
|
sap |
15y ago |
Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the Vs… |
| CVE-2010-2590 |
critical |
— |
10.0 |
EXP |
|
sap |
16y ago |
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute… |
| CVE-2010-4556 |
critical |
— |
9.3 |
|
|
sap |
16y ago |
Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2) LoadTh… |
| CVE-2010-3983 |
critical |
— |
9.0 |
|
|
sap |
16y ago |
CmcApp in SAP BusinessObjects Enterprise XI 3.2 allows remote authenticated users to gain privileges via vectors involving the Program Job Server and the Program Login property. |
| CVE-2010-3982 |
medium |
— |
5.0 |
|
|
sap |
16y ago |
SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to trigger TCP connections to arbitrary intranet hosts on any port, and obtain potentially sensitive information about open ports, via th… |
| CVE-2010-3981 |
medium |
— |
4.3 |
|
|
sap |
16y ago |
Cross-site scripting (XSS) vulnerability in SAP BusinessObjects Enterprise XI 3.2 allows remote attackers to inject arbitrary web script or HTML via the ServiceClass field to the Edit Service Paramet… |
| CVE-2010-3980 |
medium |
— |
4.0 |
|
|
sap |
16y ago |
Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested, which allows remote authenticated users to cause a denial of service via a large numCuids … |
