SAP NetWeaver vulnerabilities
7 known CVE vulnerabilities in SAP NetWeaver, translated and rated.
- CVE-2017-9845High
Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.
- CVE-2016-3635High
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
- CVE-2015-5067High
The Cross-System Tools and Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
- CVE-2014-4003High
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
- CVE-2015-7241Critical
The XXE vulnerability in SAP Netweaver before version 7.01 allows an attacker to exploit external XML entities to gain access to system data.
- CVE-2016-10311Critical
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
- CVE-2026-58246Medium
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.