Veille CVE

Recherche « Sap netweaver »

34 CVE

Critique 10 Élevée 7 Moyenne 17 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Sap netweaver » ✕
  1. CVE-2026-89122 6.1 Moyenne

    SAP_SE SAP NetWeaver Enterprise Portal

    SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability.

  2. CVE-2026-89118 5.3 Moyenne

    SAP_SE SAP NetWeaver Enterprise Portal

    SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.

  3. CVE-2026-89117 6.1 Moyenne

    SAP_SE SAP NetWeaver Enterprise Portal

    SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.

  4. CVE-2026-89110 9.9 Critique

    SAP_SE SAP NetWeaver Visual Composer

    SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

  5. CVE-2026-76976 5.4 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

    Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

  6. CVE-2026-58249 7.5 Élevée

    SAP_SE SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

    SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

  7. CVE-2026-76967 7.8 Élevée

    SAP_SE SAP NetWeaver Business Client

    SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application.

  8. CVE-2026-76963 4.3 Moyenne

    SAP_SE SAP NetWeaver and ABAP Platform

    Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.

  9. CVE-2026-66768 9.0 Critique

    SAP_SE SAP NetWeaver (SAP GUI for Java)

    SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.

  10. CVE-2026-66767 7.7 Élevée

    SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform

    SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.

  11. CVE-2026-58240 9.8 Critique

    SAP_SE SAP NetWeaver (Message Server)

    SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

  12. CVE-2026-66779 6.3 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP

    Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.

  13. CVE-2026-58243 8.8 Élevée

    SAP_SE SAP ABAP Developer Tools

    SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

  14. CVE-2026-58241 4.2 Moyenne

    SAP_SE SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard

    SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.

  15. CVE-2026-58236 5.5 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

  16. CVE-2026-58235 6.3 Moyenne

    SAP_SE SAP NetWeaver AS Java (Adobe Document Services)

    SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.

  17. CVE-2026-34265 9.8 Critique

    SAP_SE SAP NetWeaver and ABAP Platform

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

  18. CVE-2026-58246 4.3 Moyenne

    SAP_SE SAP NetWeaver Application Server for ABAP

    SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

  19. CVE-2026-44760 4.7 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)

    Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.

  20. CVE-2026-44759 6.1 Moyenne

    SAP_SE SAP NetWeaver Enterprise Portal

    SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.

  21. CVE-2026-44752 8.2 Élevée

    SAP_SE SAP NetWeaver Application Server Java(Configuration Wizard)

    SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.

  22. CVE-2026-44747 9.9 Critique

    SAP_SE SAP NetWeaver Application Server ABAP

    SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.

  23. CVE-2026-44751 7.1 Élevée

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

  24. CVE-2026-44748 9.9 Critique

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

  25. CVE-2026-44746 6.1 Moyenne

    SAP_SE SAP NetWeaver AS Java (JDBC Test Servlet)

    Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticated attacker could craft a URL that embeds a malicious script. If a victim clicks this link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim's browser. This could allow the attacker to access and/or modify information related to the webclient, impacting the confidentiality and integrity of the application, with no impact to availability.

  26. CVE-2026-40128 9.0 Critique

    SAP_SE SAP NetWeaver Application Server Java (Web Container)

    SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

  27. CVE-2026-27671 9.8 Critique

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

  28. CVE-2026-27680 4.3 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP · Sap netweaver application server abap

    Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.

  29. CVE-2026-40135 6.5 Moyenne

    SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform · Sap netweaver application server abap

    An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

  30. CVE-2026-40129 4.3 Moyenne

    SAP_SE SAP Application Server ABAP for SAP NetWeaver and ABAP Platform

    Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result in execution. Successful exploitation could enable the attacker to execute arbitrary code for other users, resulting in a low impact on the integrity, with no impact to the confidentiality and availability of the system.

  31. CVE-2026-27682 6.1 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) · Sap netweaver application server abap

    Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access and/or modify information, impacting the confidentiality and integrity of the application, with no impact to availability.

  32. CVE-2025-31324 9.8 Critique Exploitée Rançongiciel

    SAP_SE SAP NetWeaver (Visual Composer development server) · Sap netweaver

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

  33. CVE-2022-22536 10.0 Critique Exploitée

    SAP SE SAP NetWeaver and ABAP Platform · SAP SE SAP Web Dispatcher · SAP SE SAP Content Server · Sap content server

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

  34. CVE-2017-12637 7.5 Élevée Exploitée

    Sap netweaver application server java

    Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.