Netweaver Application Server Java (Sap) - vulnerabilities (CVEs)

70 CVEs, 0 in the last 30 days, 46 known versions, newest CVE from 2026-04-14. Vendor: Sap.

CVEs of Netweaver Application Server Java

CVE-2026-27674 - CVSS 6.1 (medium), 2026-04-14: Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that…
CVE-2026-23686 - CVSS 3.4 (low), 2026-02-10: Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially…
CVE-2025-42926 - CVSS 5.3 (medium), 2025-09-09: SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web…
CVE-2024-47592 - CVSS 5.3 (medium), 2024-11-12: SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an…
CVE-2024-34688 - CVSS 7.5 (high), 2024-06-11: Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may…
CVE-2024-28164 - CVSS 5.3 (medium), 2024-06-11: SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be…
CVE-2024-22127 - CVSS 9.1 (critical), 2024-03-12: SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous…
CVE-2024-24743 - CVSS 8.6 (high), 2024-02-13: SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over…
CVE-2024-22126 - CVSS 8.8 (high), 2024-02-13: The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before…
CVE-2023-42480 - CVSS 5.3 (medium), 2023-11-14: The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user…
CVE-2023-42477 - CVSS 6.5 (medium), 2023-10-10: SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing…
CVE-2023-40309 - CVSS 9.8 (critical), 2023-09-12: SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user,…
CVE-2023-40308 - CVSS 7.5 (high), 2023-09-12: SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library…
CVE-2023-24526 - CVSS 5.3 (medium), 2023-03-14: SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user…
CVE-2022-41262 - CVSS 6.1 (medium), 2022-12-12: Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into…
CVE-2022-26103 - CVSS 5.3 (medium), 2022-03-10: Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to…
CVE-2022-22533 - CVSS 7.5 (high), 2022-02-09: Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL…
CVE-2022-22532 - CVSS 9.8 (critical), 2022-02-09: In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an…
CVE-2021-37535 - CVSS 10 (critical), 2021-09-14: SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks…
CVE-2021-33689 - CVSS 4.3 (medium), 2021-07-14: When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no…
CVE-2021-33687 - CVSS 4.9 (medium), 2021-07-14: SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an…
CVE-2021-33670 - CVSS 7.5 (high), 2021-07-14: SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP…
CVE-2021-27601 - CVSS 5.4 (medium), 2021-04-13: SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim…
CVE-2021-27598 - CVSS 6.5 (medium), 2021-04-13: SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product…
CVE-2021-21492 - CVSS 4.3 (medium), 2021-04-13: SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs,…
CVE-2021-21485 - CVSS 7.4 (high), 2021-04-13: An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java that allow the…
CVE-2021-21491 - CVSS 6.1 (medium), 2021-03-10: SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allow an attacker to…
CVE-2020-26829 - CVSS 10 (critical), 2020-12-09: SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of…
CVE-2020-26826 - CVSS 6.5 (medium), 2020-12-09: Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including script files) without…
CVE-2020-26816 - CVSS 5.4 (medium), 2020-12-09: SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key…
CVE-2020-26820 - CVSS 9.1 (critical), 2020-11-10: SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console,…
CVE-2020-6365 - CVSS 6.1 (medium), 2020-10-15: SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a…
CVE-2020-6319 - CVSS 6.1 (medium), 2020-10-15: SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks…
CVE-2020-6313 - CVSS 6.5 (medium), 2020-09-09: SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an…
CVE-2020-6309 - CVSS 7.5 (high), 2020-08-12: SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication…
CVE-2020-6287 - CVSS 10 (critical), 2020-07-14: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without…
CVE-2020-6286 - CVSS 5.3 (medium), 2020-07-14: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31,…
CVE-2020-6282 - CVSS 5.8 (medium), 2020-07-14: SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS),…
CVE-2020-6263 - CVSS 9.8 (critical), 2020-06-10: Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50;…
CVE-2020-6224 - CVSS 6.2 (medium), 2020-04-14: SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user…
CVE-2020-6202 - CVSS 7.2 (high), 2020-03-10: SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP…
CVE-2020-6190 - CVSS 5.8 (medium), 2020-02-12: Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system…
CVE-2019-0391 - CVSS 4.3 (medium), 2019-11-13: Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would…
CVE-2019-0389 - CVSS 8.8 (high), 2019-11-13: An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for…
CVE-2019-0355 - CVSS 7.2 (high), 2019-09-10: SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0,…
CVE-2019-0345 - CVSS 9.8 (critical), 2019-08-14: A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31,…
CVE-2019-0327 - CVSS 7.2 (high), 2019-07-10: SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4,…
CVE-2019-0318 - CVSS 5.3 (medium), 2019-07-10: Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to…
CVE-2019-0275 - CVSS 5.4 (medium), 2019-03-12: SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not…
CVE-2018-2503 - CVSS 7.4 (high), 2018-12-11: By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in…
CVE-2018-2492 - CVSS 7.1 (high), 2018-12-11: SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions…
CVE-2018-2504 - CVSS 6.1 (medium), 2018-12-11: SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or…
CVE-2018-2452 - CVSS 6.1 (medium), 2018-09-11: The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in a…
CVE-2017-14581 - CVSS 7.5 (high), 2017-09-19: The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted…
CVE-2017-12637 - CVSS 7.5 (high), 2017-08-07: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers…
CVE-2017-11458 - CVSS 6.1 (medium), 2017-07-25: Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web…
CVE-2017-11457 - CVSS 6.5 (medium), 2017-07-25: XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct…
CVE-2017-8913 - CVSS 8.8 (high), 2017-05-23: The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a…
CVE-2017-7717 - CVSS 8.8 (high), 2017-04-14: SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to…
CVE-2016-10304 - CVSS 6.5 (medium), 2017-04-10: The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service…
CVE-2016-9563 - CVSS 6.5 (medium), 2016-11-23: BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the…
CVE-2016-9562 - CVSS 7.5 (high), 2016-11-23: SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the…
CVE-2010-5326 - CVSS 10 (critical), 2016-05-13: The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to…
CVE-2015-8840 - CVSS 8.8 (high), 2016-04-08: The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive…
CVE-2016-3976 - CVSS 7.5 (high), 2016-04-07: Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in…
CVE-2016-3975 - CVSS 6.1 (medium), 2016-04-07: Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2016-3974 - CVSS 9.1 (critical), 2016-04-07: XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of…
CVE-2016-3973 - CVSS 5.3 (medium), 2016-04-07: The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain…
CVE-2016-2388 - CVSS 5.3 (medium), 2016-02-16: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka…
CVE-2016-2386 - CVSS 9.8 (critical), 2016-02-16: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified…