Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
670 results · page 5 of 14
Apr 8, 2024SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internCVE-2024-27898 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.
- Product
- SAP NetWeaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 11, 2024Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otheCVE-2024-28163 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) - versions 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.
- Product
- SAP NetWeaver Process Integration (Support Web Pages)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 11, 2024Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-SitCVE-2024-27902 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
- Product
- SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 11, 2024Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing loCVE-2024-25645 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing low impact on confidentiality of the application and with no impact on Integrity and Availability of the application.
- Product
- SAP NetWeaver (Enterprise Portal)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 11, 2024Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on CVE-2024-25644 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, causing low impact on Confidentiality with no impact on Integrity and Availability of the application.
- Product
- NetWeaver (WSRM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Mar 11, 2024SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous fCVE-2024-22127 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands which can cause high impact on confidentiality, integrity and availability of the application.
- Product
- SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
Feb 12, 2024SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over thCVE-2024-24743 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.6
SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so that availability is not affected.
- Product
- SAP NetWeaver AS Java (Guided Procedures)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, undCVE-2024-24740 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted with low impact on confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP (SAP Kernel)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently eCVE-2024-22128 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious javascript to cause limited impact to confidentiality and integrity of the application data after successful exploitation.
- Product
- SAP NetWeaver Business Client for HTML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before incluCVE-2024-22126 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.
- Product
- SAP NetWeaver AS Java (User Admin Application)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2024An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellController component.CVE-2023-51892 · Other software · Weaver · reported by MITRECritical 9.8
An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellController component.
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comweaver.com.cn
Jan 11, 2024Weaver Xtreme: Stored Cross-Site ScriptingCVE-2023-6990 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Weaver Xtreme
- Affected
- up to 6.3.0
- What to do
- Affects up to 6.3.0. Update Weaver Xtreme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgwordfence.com
Jan 8, 2024Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7CVE-2024-22124 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7.54, could allow an attacker to access information which would otherwise be restricted causing high impact on confidentiality.
- Product
- SAP NetWeaver (Internet Communication Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2024SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilityCVE-2024-21738 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation.
- Product
- SAP NetWeaver ABAP Application Server and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2023SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential.CVE-2023-49581 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doing so the attacker could increase response times of the AS ABAP, leading to mild impact on availability.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids.CVE-2023-42480 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.
- Product
- NetWeaver AS Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.9CVE-2023-41366 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT, allows an unauthenticated attacker to access the unintended data due to the lack of restrictions applied which may lead to low impact in confidentiality and no impact on the integrity and availability of the application.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Weaver Xtreme Theme Support: Unserialises the content of an imported fileCVE-2023-4971 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
- Product
- Weaver Xtreme Theme Support
- Fixed in
- 6.3.1
- What to do
- Update Weaver Xtreme Theme Support to 6.3.1 or newer.
Oct 9, 2023SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limitCVE-2023-42477 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver AS Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS CVE-2023-40624 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application.
- Product
- SAP NetWeaver AS ABAP (applications based on Unified Rendering)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to adminCVE-2023-41367 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admin view of specific function anonymously. On successful exploitation of vulnerability under specific circumstances, attacker can view user’s email address. There is no integrity/availability impact.
- Product
- SAP NetWeaver (Guided Procedures)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAPCVE-2023-37492 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.9
SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 793, SAP_BASIS 804, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read sensitive information which can be used in a subsequent serious attack.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could resulCVE-2023-37488 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of the system.
- Product
- SAP NetWeaver Process Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2023An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2023-34798 · Other software · Weaver · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- E-office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 20, 2023A vulnerability was found in Weaver e-cology.CVE-2023-3793 · Other software · Weaver · reported by VulDBMedium 5.5
A vulnerability was found in Weaver e-cology. It has been rated as critical. This issue affects some unknown processing of the file filelFileDownloadForOutDoc.class of the component HTTP POST Request Handler. The manipulation of the argument fileid with the input 1+WAITFOR+DELAY leads to sql injection. Upgrading to version 10.58.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-235061 was assigned to this vulnerability.
- Product
- e-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way.CVE-2023-34236 · Other software · weaveworks · reported by GitHubHigh 8.5
Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system. This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users
- Product
- tf-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.2CVE-2023-35874 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities tCVE-2023-35873 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
- Product
- SAP NetWeaver Process Integration (Runtime Workbench)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities CVE-2023-35872 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
- Product
- SAP NetWeaver Process Integration (Message Display Tool)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to ovCVE-2023-33989 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can be over-written leading to system compromise.
- Product
- SAP NetWeaver (BI CONT ADD ON)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network whiCVE-2023-31405 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.
- Product
- SAP NetWeaver AS for Java (Log Viewer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site ScriptinCVE-2023-33985 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 12, 2023SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker toCVE-2023-33984 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability.
- Product
- SAP NetWeaver (Design Time Repository)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 12, 2023SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privilegesCVE-2023-32114 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.7
SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavailable which may lead to a limited impact on Availability with No impact on Confidentiality and Integrity of the application.
- Product
- SAP NetWeaver (Change and Transport System)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 9, 2023Weaver Show Posts: Stored Cross-Site ScriptingCVE-2023-1404 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Weaver Show Posts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Weaver Show Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023Weaver Xtreme: Stored Cross-Site ScriptingCVE-2023-1403 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Weaver Xtreme
- Affected
- up to 5.0.7
- What to do
- Affects up to 5.0.7. Update Weaver Xtreme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgwordfence.com
May 19, 2023A vulnerability classified as problematic was found in Weaver e-cology up to 9.0.CVE-2023-2806 · Other software · Weaver · reported by VulDBMedium 5.5
A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- e-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023A vulnerability was found in Weaver OA 9.5 and classified as problematic.CVE-2023-2766 · Other software · Weaver · reported by VulDBMedium 5.3
A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic.CVE-2023-2765 · Other software · Weaver · reported by VulDBMedium 4.3
A vulnerability has been found in Weaver OA up to 9.5 and classified as problematic. This vulnerability affects unknown code of the file /E-mobile/App/System/File/downfile.php. The manipulation of the argument url leads to absolute path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-229270 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability was found in Weaver E-Office 9.5.CVE-2023-2648 · Other software · Weaver · reported by VulDBMedium 6.3
A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023A vulnerability was found in Weaver E-Office 9.5 and classified as critical.CVE-2023-2647 · Other software · Weaver · reported by VulDBMedium 6.3
A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use oCVE-2023-30744 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called without further authorization and authentication. A subsequent call to one of these methods can read or change the state of existing services without any effect on availability.
- Product
- SAP AS NetWeaver JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 4, 2023A vulnerability was found in Weaver E-Office 9.5.CVE-2023-2523 · Other software · Weaver · reported by VulDBHigh 7.3
A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228014 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Weaver Xtreme Theme Support: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0276 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Weaver Xtreme Theme Support
- Fixed in
- 6.2.7
- What to do
- Update Weaver Xtreme Theme Support to 6.2.7 or newer.
Apr 11, 2023In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on CVE-2023-29186 · Network & remote access · SAP · reported by cna@sap.comHigh 8.7
In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.
- Product
- NetWeaver (BI CONT ADDON)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 11, 2023SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated aCVE-2023-29185 · Network & remote access · SAP · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.
- Product
- NetWeaver AS for ABAP (Business Server Pages)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrativCVE-2023-28763 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.
- Product
- NetWeaver AS for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service wCVE-2023-28761 · Network & remote access · SAP · reported by cna@sap.comMedium 6.5
In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on confidentiality and integrity.
- Product
- NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 10, 2023SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unCVE-2023-24527 · Network & remote access · SAP · reported by cna@sap.comMedium 5.3
SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.
- Product
- NetWeaver AS Java for Deploy Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Mar 14, 2023SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufCVE-2023-27501 · Network & remote access · SAP · reported by cna@sap.comHigh 8.7
SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw in an available service to delete system files. In this attack, no data can be read but potentially critical OS files can be deleted making the system unavailable, causing significant impact on both availability and integrity
- Product
- NetWeaver AS for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.