CVE-2005-3635: sap sap_web_application_server

EPSS trend

Probability

5.03%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 5.03% on 21-09-2026

21-09-202621-10-2026

EPSS score

5.03%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securitytracker.com)
Maturity: unknown
exploit-databasephpVerified
SAP Web Application Server 6.x/7.0 - 'frameset.htm?sap-syscmd' Cross-Site Scripting
Maturity: poc

References

10 links

www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdfX Refsource MISC
www.osvdb.org/20717VDB EntryX Refsource OSVDB
securityreason.com/securityalert/162Third Party AdvisoryX Refsource SREASON
exchange.xforce.ibmcloud.com/vulnerabilities/23027VDB EntryX Refsource XF
www.securityfocus.com/bid/15361VDB EntryX Refsource BIDExploit
secunia.com/advisories/17515/Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/alerts/2005/Nov/1015174.htmlVDB EntryX Refsource SECTRACKExploitVendor Advisory
www.vupen.com/english/advisories/2005/2361VDB EntryX Refsource VUPEN
www.osvdb.org/20716VDB EntryX Refsource OSVDB
marc.info?l=bugtraq&m=113156601505542&w=2Mailing ListX Refsource BUGTRAQ

Related vulnerabilities

CVE-2007-3615sapsap_web_application_server2.35%19y ago06-07-2007 19:00Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web cache.CVE-2005-3634sapsap_web_application_server17.76%20y ago16-11-2005 21:17frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.CVE-2005-3633sapsap_web_application_server2.05%20y ago16-11-2005 21:17HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.CVE-2005-3636sapsap_web_application_server5.05%20y ago16-11-2005 21:17Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages.CVE-2008-2421sapsap_web_application_server+11.83%18y ago23-05-2008 15:00Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.CVE-2006-1039sapsap_web_application_server2.74%20y ago07-03-2006 11:00SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.

All vulnerabilities insap_web_application_server

CVE-2005-3635: sap sap_web_application_server

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References