SAP

Records1968All Threatist records

Exploited (KEV)14In CISA KEV

CVSS critical221CVSS 9.0–10.0

CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV

TI-2025-27866 SAP NetWeaver Deserialization Vulnerability CRITICAL 98KEV 2025-05-15 TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability CRITICAL 100KEV 2025-04-29 TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability CRITICAL 90KEV 2025-03-19 TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2024-09-30 TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability CRITICAL 100KEV 2022-08-18 TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records

3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

11 records in Sap Web Application Server · all components

TI-2005-03430 CVE-2005-3634 · GHSA-8648-qmcx-pvc2

frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00…

MEDIUM 40

frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.17757 Published 2005-11-16 No fix listed

TI-2007-03506 CVE-2007-3615 · GHSA-444g-7h8r-45m8

Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server…

LOW 39

Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.02354 Published 2007-07-06 No fix listed

TI-2006-05778 CVE-2006-6010 · GHSA-66r7-7rjm-h7pp

SAP allows remote attackers to obtain potentially sensitive information such as operating…

LOW 38

SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.14278 Published 2006-11-21 No fix listed

TI-2006-01009 CVE-2006-1039 · GHSA-fcph-vwq2-2v5x

SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject…

LOW 34

SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.02738 Published 2006-03-07 No fix listed CWE-94

TI-2005-03432 CVE-2005-3636 · GHSA-rr23-7g46-v945

Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows…

LOW 28

Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05054 Published 2005-11-16 No fix listed

TI-2005-03431 CVE-2005-3635 · GHSA-6p7q-wq2w-35w3

Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS)…

LOW 28

Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the Bsp…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05031 Published 2005-11-16 No fix listed

TI-2006-05568 CVE-2006-5784 · GHSA-gmrg-288v-3xmw

Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch…

LOW 27

Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted data on a "3200+SYSNR" TCP port, as demon…

CVSS 2.0MEDIUM 4.6 Local No auth Interaction — EPSS 0.02924 Published 2006-11-07 No fix listed

TI-2005-03429 CVE-2005-3633 · GHSA-63pq-5rx5-8rwj

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS)…

LOW 27

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02047 Published 2005-11-16 No fix listed

TI-2006-05569 CVE-2006-5785 · GHSA-xq66-7995-4f8c

Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00…

LOW 26

Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service (enserver.exe crash) via a 0x72F2 sequence on UDP port 64999.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01822 Published 2006-11-07 No fix listed

TI-2006-05779 CVE-2006-6011 · GHSA-9cfp-gqqf-982j

Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote…

LOW 25

Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a d…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01207 Published 2006-11-21 No fix listed

TI-2008-02321 CVE-2008-2421 · GHSA-2ch6-jww2-3r97

Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server…

LOW 24

Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTM…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01826 Published 2008-05-23 No fix listed CWE-79

Open these records in search →

Critical	221
High	534
Medium	1145
Low	68
No CVSS	0