NE
Product
NetWeaver
On CISA KEVExploited in the wildRansomware-linked
113
CVEs
10
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 13High 22Medium 28Low 2
Watch
Add NetWeaver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-1911 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime… Affected: 7.40 |
| CVE-2019-0248 | 5.9 | Jan 8 | Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would… Affected: 7.5; 7.51; 7.52; 7.53 |
| CVE-2020-6181 | 5.8 | Feb 12 | Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753,… Affected: 7.02; 7.30; 7.31; 7.40 |
| CVE-2023-33984 | 5.4 | Jun 13 | SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with… Affected: 7.50 |
| CVE-2020-6185 | 5.4 | Feb 12 | Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated… Affected: 7.40 |
| CVE-2024-28164 | 5.3 | Jun 11 | Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures) Affected: 7.50 |
| CVE-2024-27898 | 5.3 | Apr 9 | Server-Side Request Forgery in SAP NetWeaver Affected: 7.5 |
| CVE-2024-25644 | 5.3 | Mar 12 | Information Disclosure vulnerability in NetWeaver (WSRM) Affected: 7.50 |
| CVE-2023-41367 | 5.3 | Sep 12 | Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific… Affected: 7.50 |
| CVE-2016-1910 | 5.3 | Jan 15 | The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290 Affected: 7.40 |
| CVE-2026-23685 | 4.4 | Feb 10 | Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) Affected: 7.50 |
| CVE-2025-42968 | 4.3 | Jul 8 | Missing Authorization check in SAP NetWeaver (RFC enabled function module) Affected: 700; 701; 702; 710; 731; 740; +12 more |
| CVE-2018-2434 | 4.3 | Jul 10 | A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP… Affected: 7.0 |
| CVE-2016-7437 | 3.3 | Oct 13 | SAP Netweaver 7.40 improperly logs (1) DUI and (2) DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC… Affected: 7.40 |
| CVE-2023-32114 | 2.7 | Jun 13 | SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run… Affected: 702; 731; 740; 750; 751; 752; +5 more |
| CVE-2015-6662 | – | Aug 24 | XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML… Affected: 7.40 |
| CVE-2015-5067 | – | Jun 24 | The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka… Affected: All versions, or not specified |
| CVE-2015-2817 | – | Apr 1 | The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768 Affected: 7.40 |
| CVE-2015-2815 | – | Apr 1 | Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to… Affected: 7.0; 7.40 |
| CVE-2014-0995 | – | Nov 6 | The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level… Affected: through 7.01; 7.20 |
| CVE-2014-8592 | – | Nov 4 | Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via a crafted… Affected: 7.02; 7.30 |
| CVE-2014-8591 | – | Nov 4 | Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process… Affected: 7.02; 7.30 |
| CVE-2014-8587 | – | Nov 4 | SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature… Affected: All versions, or not specified |
| CVE-2014-6252 | – | Sep 5 | Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of… Affected: 7.0; 7.20 |
| CVE-2014-4003 | – | Jun 9 | The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system Affected: All versions, or not specified |
| CVE-2014-3787 | – | May 19 | SAP NetWeaver 7.20 and earlier allows remote attackers to read arbitrary SAP Central User Administration (SAP CUA) tables via unspecified vectors Affected: through 7.20; 7.0; 7.0; 7.0; 7.0; 7.0; +4 more |
| CVE-2013-7364 | – | Apr 10 | An unspecified J2EE core service in the J2EE Engine in SAP NetWeaver does not properly restrict access, which allows remote attackers to read and write to arbitrary files via… Affected: All versions, or not specified |
| CVE-2014-1965 | – | Feb 14 | Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10… Affected: 3.0; 7.0; 7.01; 7.02; 7.10; 7.11 |
| CVE-2014-1964 | – | Feb 14 | Cross-site scripting (XSS) vulnerability in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component in SAP NetWeaver allows remote attackers to inject… Affected: All versions, or not specified |
| CVE-2014-1963 | – | Feb 14 | Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors Affected: 7.20 |
| CVE-2014-1961 | – | Feb 14 | Unspecified vulnerability in the Portal WebDynPro in SAP NetWeaver allows remote attackers to obtain sensitive path information via unknown attack vectors Affected: All versions, or not specified |
| CVE-2014-1960 | – | Feb 14 | The Solution Manager in SAP NetWeaver does not properly restrict access, which allows remote attackers to obtain sensitive information via unspecified vectors Affected: All versions, or not specified |
| CVE-2013-7094 | – | Dec 13 | SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 7.30 |
| CVE-2013-6869 | – | Nov 23 | SQL injection vulnerability in the SRTT_GET_COUNT_BEFORE_KEY_RFC function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 7.30 |
| CVE-2013-6823 | – | Nov 20 | GRMGApp in SAP NetWeaver allows remote attackers to bypass intended access restrictions via unspecified vectors Affected: All versions, or not specified |
| CVE-2013-6822 | – | Nov 20 | GRMGApp in SAP NetWeaver allows remote attackers to have unspecified impact and attack vectors, related to an XML External Entity (XXE) issue Affected: All versions, or not specified |
| CVE-2013-6821 | – | Nov 20 | Directory traversal vulnerability in the Exportability Check Service in SAP NetWeaver allows remote attackers to read arbitrary files via unspecified vectors Affected: All versions, or not specified |
| CVE-2013-6819 | – | Nov 20 | Cross-site scripting (XSS) vulnerability in Performance Provider in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: All versions, or not specified |
| CVE-2013-6816 | – | Nov 20 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web… Affected: All versions, or not specified |
| CVE-2013-6815 | – | Nov 20 | The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified… Affected: through 7.31; 4.0; 6.4; 7.0; 7.0; 7.0; +7 more |
| CVE-2013-6814 | – | Nov 20 | The J2EE Engine in SAP NetWeaver 6.40, 7.02, and earlier allows remote attackers to redirect users to arbitrary web sites, conduct phishing attacks, and obtain sensitive… Affected: through 7.02; 6.4 |
| CVE-2013-6244 | – | Oct 24 | The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and… Affected: through 7.31; 4.0; 6.4; 7.0; 7.01; 7.02; +3 more |
| CVE-2013-5751 | – | Sep 16 | Directory traversal vulnerability in SAP NetWeaver 7.x allows remote attackers to read arbitrary files via unspecified vectors Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.01; +4 more |
| CVE-2013-5723 | – | Sep 12 | SQL injection vulnerability in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "ABAD0_DELETE_DERIVATION_TABLE." Affected: 7.30 |
| CVE-2013-3319 | – | Aug 16 | The GetComputerSystem method in the HostControl service in SAP Netweaver 7.03 allows remote attackers to obtain sensitive information via a crafted SOAP request to TCP port 1128 Affected: 7.03 |
| CVE-2011-5263 | – | Feb 12 | Cross-site scripting (XSS) vulnerability in RetrieveMailExamples in SAP NetWeaver 7.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the server… Affected: through 7.30; 7.0; 7.0; 7.0; 7.0; 7.0; +3 more |
| CVE-2011-5260 | – | Feb 12 | Cross-site scripting (XSS) vulnerability in SAP/BW/DOC/METADATA in SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via the page parameter Affected: 4.0; 6.4; 7.0; 7.0; 7.0; 7.0; +1 more |
| CVE-2012-2612 | – | May 15 | The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of… Affected: 7.0; 7.0 |
| CVE-2012-2611 | – | May 15 | The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain… Affected: 7.0; 7.0 |
| CVE-2012-2514 | – | May 15 | The DiagiEventSource function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial… Affected: 7.0; 7.0 |