CVE-2005-3634: sap sap_web_application_server

EPSS trend

Probability

17.76%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 17.76% on 21-09-2026

21-09-202621-10-2026

EPSS score

17.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
SAP Web Application Server 6.x/7.0 - Open Redirection
Maturity: poc

References

8 links

www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdfX Refsource MISC
exchange.xforce.ibmcloud.com/vulnerabilities/23031VDB EntryX Refsource XF
www.securityfocus.com/bid/15362VDB EntryX Refsource BIDExploit
securityreason.com/securityalert/163Third Party AdvisoryX Refsource SREASON
marc.info?l=bugtraq&m=113156525006667&w=2Mailing ListX Refsource BUGTRAQ
secunia.com/advisories/17515/Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/alerts/2005/Nov/1015174.htmlVDB EntryX Refsource SECTRACKVendor Advisory
www.vupen.com/english/advisories/2005/2361VDB EntryX Refsource VUPEN

Related vulnerabilities

CVE-2007-3615sapsap_web_application_server2.35%19y ago06-07-2007 19:00Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web cache.CVE-2005-3635sapsap_web_application_server5.03%20y ago16-11-2005 21:17Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application.CVE-2005-3633sapsap_web_application_server2.05%20y ago16-11-2005 21:17HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.CVE-2005-3636sapsap_web_application_server5.05%20y ago16-11-2005 21:17Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages.CVE-2008-2421sapsap_web_application_server+11.83%18y ago23-05-2008 15:00Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.CVE-2006-1039sapsap_web_application_server2.74%20y ago07-03-2006 11:00SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.

All vulnerabilities insap_web_application_server

CVE-2005-3634: sap sap_web_application_server

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References