Sap Netweaver Application Server Java vulnerabilities, page 4
69 vulnerabilities
Known vulnerabilities in Sap Netweaver Application Server Java, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2019-0327sap se · sap netweaver for java application server - web container (engineapi) +2 moresap se sap netweaver for java application server - web container (engineapi)SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.EPSS2.10%HighCVE-2019-0355sap se · sap netweaver as for java (web container)-engineapi +2 moresap se sap netweaver as for java (web container)-engineapiSAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.EPSS1.56%MediumCVE-2026-27674sap_se · sap netweaver application server java (web dynpro java) +1 moreCode Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.EPSS0.29%LowCVE-2026-23686sap_se · sap netweaver application server java +1 moreCRLF Injection vulnerability in SAP NetWeaver Application Server JavaDue to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.EPSS0.19%HighCVE-2023-40308sap_se · sap commoncryptolib +16 moreMemory Corruption vulnerability in SAP CommonCryptoLibSAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view or modify any information.EPSS0.75%CriticalCVE-2023-40309sap_se · sap commoncryptolib +16 moreMissing Authorization check in SAP CommonCryptoLibSAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.EPSS0.88%MediumCVE-2023-42477sap_se · sap netweaver as java +1 moreServer-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.EPSS0.47%MediumCVE-2023-42480sap_se · netweaver as java +1 moreInformation Disclosure in NetWeaver AS Java LogonThe unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an impact on confidentiality but there is no other impact on integrity or availability.EPSS0.55%MediumCVE-2023-24526sap · netweaver_application_server_java +1 moreImproper Access Control in SAP NetWeaver AS Java (Classload Service)SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data.EPSS0.58%