CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities Published In 2013

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-7096 89 Exec Code Sql 2013-12-13 2013-12-19
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
2 CVE-2013-7095 2013-12-13 2013-12-19
10.0
None Remote Low Not required Complete Complete Complete
The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.
3 CVE-2013-7094 89 Exec Code Sql 2013-12-13 2013-12-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
4 CVE-2013-7093 287 Bypass 2013-12-13 2013-12-16
5.0
None Remote Low Not required None Partial None
SAP Network Interface Router (SAProuter) 39.3 SP4 allows remote attackers to bypass authentication and modify the configuration via unspecified vectors.
5 CVE-2013-6869 89 Exec Code Sql 2013-11-23 2013-12-08
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
6 CVE-2013-6823 264 Bypass 2013-11-20 2013-11-20
6.4
None Remote Low Not required Partial Partial None
GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors.
7 CVE-2013-6822 2013-11-20 2013-11-20
10.0
None Remote Low Not required Complete Complete Complete
GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue.
8 CVE-2013-6821 22 Dir. Trav. 2013-11-20 2013-11-20
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors.
9 CVE-2013-6820 Exec Code 2013-11-20 2013-11-20
9.3
None Remote Medium Not required Complete Complete Complete
Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.
10 CVE-2013-6819 79 XSS 2013-11-20 2013-11-20
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
11 CVE-2013-6818 264 Bypass 2013-11-20 2013-11-20
6.4
None Remote Low Not required Partial Partial None
SAP NetWeaver Logviewer 6.30, when running on Windows, allows remote attackers to bypass intended access restrictions via unspecified vectors.
12 CVE-2013-6817 119 DoS Exec Code Overflow 2013-11-20 2013-11-20
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages.
13 CVE-2013-6816 79 XSS 2013-11-20 2013-11-20
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
14 CVE-2013-6815 20 DoS 2013-11-20 2013-11-21
5.0
None Remote Low Not required None None Partial
The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue.
15 CVE-2013-6814 20 +Info 2013-11-20 2013-11-20
5.8
None Remote Medium Not required Partial Partial None
The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive information (cookies and SAPPASSPORT) via unspecified vectors.
16 CVE-2013-6284 Exec Code 2013-10-26 2013-10-28
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Component (ECC) allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."
17 CVE-2013-6244 2013-10-23 2013-10-30
5.0
None Remote Low Not required Partial None None
The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
18 CVE-2013-5751 22 Dir. Trav. 2013-09-16 2013-10-02
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors.
19 CVE-2013-5723 89 Exec Code Sql 2013-09-12 2013-10-07
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0_DELETE_DERIVATION_TABLE."
20 CVE-2013-3319 200 +Info 2013-08-16 2013-10-07
5.0
None Remote Low Not required Partial None None
The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128.
21 CVE-2013-3244 94 Exec Code 2013-10-23 2013-10-25
6.0
None Remote Medium Single system Partial Partial Partial
Multiple unspecified vulnerabilities in the CJDB_FILL_MEMORY_FROM_PPB function in the Project System (PS-IS) module for SAP ERP Central Component (ECC) allow remote attackers to execute arbitrary code via a (1) RFC or (2) SOAP-RFC request.
22 CVE-2013-3063 Exec Code 2013-05-01 2013-11-18
6.0
None Remote Medium Single system Partial Partial Partial
SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
23 CVE-2013-3062 264 Bypass 2013-05-01 2014-03-07
6.5
None Remote Low Single system Partial Partial Partial
The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.
24 CVE-2013-3061 264 Bypass 2013-05-01 2013-11-18
6.5
None Remote Low Single system Partial Partial Partial
The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.
25 CVE-2011-5263 79 XSS 2013-02-12 2013-02-13
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server parameter.
26 CVE-2011-5260 79 XSS 2013-02-12 2013-02-13
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Total number of vulnerabilities : 26   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.