Overview 49 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 5 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
49
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
49
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
49
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 7 / year
20034
Not applicable4
Medium4
not blocked4
Working exploit published4
20041
Not applicable1
High1
not blocked1
Working exploit published1
20053
Not applicable3
Medium3
not blocked3
Working exploit published3
20064
Not applicable4
Medium4
not blocked4
Working exploit published4
20077
Not applicable7
High4
Medium3
not blocked7
Working exploit published7
20084
Not applicable4
High2
Medium2
not blocked4
Working exploit published4
20092
Not applicable2
High2
not blocked2
Working exploit published2
20103
Not applicable3
High3
not blocked3
Working exploit published3
20110
20126
Not applicable6
High1
Medium5
not blocked6
Working exploit published6
20130
20142
Not applicable2
Medium2
not blocked2
Working exploit published2
20151
Not applicable1
High1
not blocked1
Working exploit published1
20164
Not applicable4
Critical1
Medium3
not blocked4
Working exploit published4
20174
Not applicable4
Critical2
High2
not blocked4
Working exploit published4
20181
Not applicable1
Medium1
not blocked1
Working exploit published1
20191
Not applicable1
Critical1
not blocked1
Working exploit published1
20201
Not applicable1
Critical1
not blocked1
Working exploit published1
20210
20221
Not applicable1
High1
not blocked1
Working exploit published1
2004200620082010201220142016201820202022
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-28213 | High | 2022-04-12 | Not applicable | Working exploit published | When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS. |
| CVE-2013-1592 | Critical | 2020-01-23 | Not applicable | Working exploit published | A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. |
| CVE-2019-0285 | Critical | 2019-04-10 | Not applicable | Working exploit published | The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker. |
| CVE-2018-11415 | Medium | 2018-05-24 | Not applicable | Working exploit published | SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product. |
| CVE-2015-7241 | Critical | 2017-09-06 | Not applicable | Working exploit published | XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01. |
| CVE-2016-6256 | Critical | 2017-05-26 | Not applicable | Working exploit published | SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065. |
| CVE-2017-8852 | High | 2017-05-10 | Not applicable | Working exploit published | SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source. The problem is that the length of data written is an arbitrary number found within the file. The vendor response is SAP Security Note 2441560. |
| CVE-2016-10079 | High | 2017-02-01 | Not applicable | Working exploit published | SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port 515. |
| CVE-2016-5847 | Medium | 2016-08-13 | Not applicable | Working exploit published | SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted from an archive, possibly related to SAP Security Note 2327384. |
| CVE-2016-5845 | Medium | 2016-08-13 | Not applicable | Working exploit published | SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive file, aka SAP Security Note 2312905. |
| CVE-2016-3974 | Critical | 2016-04-07 | Not applicable | Working exploit published | XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994. |
| CVE-2016-1910 | Medium | 2016-01-15 | Not applicable | Working exploit published | The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290. |
| CVE-2015-7986 | High | 2015-10-27 | Not applicable | Working exploit published | The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428. |
| CVE-2014-0995 | Medium | 2014-11-06 | Not applicable | Working exploit published | The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern. |
| CVE-2014-0984 | Medium | 2014-04-17 | Not applicable | Working exploit published | The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack. |
| CVE-2012-2612 | Medium | 2012-05-15 | Not applicable | Working exploit published | The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. |
| CVE-2012-2611 | High | 2012-05-15 | Not applicable | Working exploit published | The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a crafted SAP Diag packet. |
| CVE-2012-2514 | Medium | 2012-05-15 | Not applicable | Working exploit published | The DiagiEventSource function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. |
| CVE-2012-2513 | Medium | 2012-05-15 | Not applicable | Working exploit published | The Diaginput function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. |
| CVE-2012-2512 | Medium | 2012-05-15 | Not applicable | Working exploit published | The DiagTraceStreamI function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. |
| CVE-2012-2511 | Medium | 2012-05-15 | Not applicable | Working exploit published | The DiagTraceAtoms function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. |
| CVE-2010-2590 | High | 2010-12-22 | Not applicable | Working exploit published | Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP3 Fix Pack 3.2 allows remote attackers to execute arbitrary code via a long ServerResourceVersion property value. |
| CVE-2009-4988 | High | 2010-08-25 | Not applicable | Working exploit published | Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000. |
| CVE-2010-1185 | High | 2010-03-29 | Not applicable | Working exploit published | Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32, and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code via an invalid length parameter in a handshake packet to TCP port 7210. NOTE: some of these details are obtained from third party information. |
| CVE-2008-4830 | High | 2009-04-16 | Not applicable | Working exploit published | Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files via the OpenDocument method. |
| CVE-2007-4475 | High | 2009-04-01 | Not applicable | Working exploit published | Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method. |
| CVE-2008-2421 | Medium | 2008-05-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/. |
| CVE-2008-2123 | Medium | 2008-05-09 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in WGate in SAP Internet Transaction Server (ITS) 6.20 allows remote attackers to inject arbitrary web script or HTML via (1) a "<>" sequence in the ~service parameter to wgate.dll, or (2) Javascript splicing in the query string, a different vector than CVE-2006-5114. |
| CVE-2008-0621 | High | 2008-02-06 | Not applicable | Working exploit published | Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands. |
| CVE-2008-0244 | High | 2008-01-12 | Not applicable | Working exploit published | SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe. |
| CVE-2007-3624 | High | 2007-07-09 | Not applicable | Working exploit published | Heap-based buffer overflow in the Message HTTP Server in SAP Message Server allows remote attackers to execute arbitrary code via a long string in the group parameter to /msgserver/html/group. |
| CVE-2007-3614 | High | 2007-07-06 | Not applicable | Working exploit published | Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter, related to sapdbwa_GetQueryString; and other unspecified vectors related to "numerous other fields." |
| CVE-2007-3613 | Medium | 2007-07-06 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in ADM:GETLOGFILE in SAP Internet Graphics Service (IGS) allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter. |
| CVE-2007-3608 | Medium | 2007-07-06 | Not applicable | Working exploit published | Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to create certain files via unspecified vectors. |
| CVE-2007-3607 | Medium | 2007-07-06 | Not applicable | Working exploit published | Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denial of service (process crash) via unspecified vectors. |
| CVE-2007-3606 | High | 2007-07-06 | Not applicable | Working exploit published | Heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control in the EnjoySAP SAP GUI, on systems using ASCII versions, allows remote attackers to execute arbitrary code via a long first argument to the LaunchGui function. |
| CVE-2007-3605 | High | 2007-07-06 | Not applicable | Working exploit published | Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attackers to execute arbitrary code via a long argument to the PrepareToPostHTML function. |
| CVE-2006-5784 | Medium | 2006-11-07 | Not applicable | Working exploit published | Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted data on a "3200+SYSNR" TCP port, as demonstrated by port 3201. NOTE: this issue can be leveraged by local users to access a named pipe as the SAPServiceJ2E user. |
| CVE-2006-5114 | Medium | 2006-10-03 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in wgate in SAP Internet Transaction Server (ITS) 6.1 and 6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) ~urlmime or (2) ~command parameter, different vectors than CVE-2003-0749. |
| CVE-2006-1039 | Medium | 2006-03-07 | Not applicable | Working exploit published | SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers. |
| CVE-2006-0731 | Medium | 2006-02-16 | Not applicable | Working exploit published | WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL inside a frame. |
| CVE-2005-3636 | Medium | 2005-11-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages. |
| CVE-2005-3635 | Medium | 2005-11-16 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application. |
| CVE-2005-3634 | Medium | 2005-11-16 | Not applicable | Working exploit published | frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. |
| CVE-2002-1576 | High | 2004-04-15 | Not applicable | Working exploit published | lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program. |
| CVE-2003-0749 | Medium | 2003-10-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in wgate.dll for SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to insert arbitrary web script and steal cookies via the ~service parameter. |
| CVE-2003-0748 | Medium | 2003-10-20 | Not applicable | Working exploit published | Directory traversal vulnerability in wgate.dll for SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the ~theme parameter and a ~template parameter with a filename followed by space characters, which can prevent SAP from effectively adding a .html extension to the filename. |
| CVE-2003-0747 | Medium | 2003-10-20 | Not applicable | Working exploit published | wgate.dll in SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to obtain potentially sensitive information such as directory structure and operating system via incorrect parameters (1) ~service, (2) ~templatelanguage, (3) ~language, (4) ~theme, or (5) ~template, which leaks the information in the resulting error message. |
| CVE-2003-0265 | Medium | 2003-05-27 | Not applicable | Working exploit published | Race condition in SDBINST for SAP database 7.3.0.29 creates critical files with world-writable permissions before initializing the setuid bits, which allows local attackers to gain root privileges by modifying the files before the permissions are changed. |