GCVE - cpe:2.3:a:sap:sap_web_application_server:7.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sap:sap_web_application_server:7.0:*:*:*:*:*:*:*

part: a version: 7.0 update: *

Vendor	Sap (`dd5aa0c0-20b0-5c86-a937-aa29f1a33b77`)
Product	Sap Web Application Server (`bf43f798-e5de-5fd0-ab8d-8ae3a986cece`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-2421`	vulnerable	2026-06-08 04:50:24.010281	Details available Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/. Published: 2008-05-23T15:00:00.000Z Updated: 2024-08-07T08:58:02.601Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/492376/100/0/threaded http://www.securityfocus.com/bid/29317 https://exchange.xforce.ibmcloud.com/vulnerabilities/42724 http://www.securitytracker.com/id?1020097 http://www.vupen.com/english/advisories/2008/1599/references	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-3615`	vulnerable	2026-06-08 04:49:54.340503	Details available Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web cache. Published: 2007-07-06T19:00:00.000Z Updated: 2024-08-07T14:21:36.422Z Open on db.gcve.eu Reference links http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0105.html https://exchange.xforce.ibmcloud.com/vulnerabilities/35278 http://www.securityfocus.com/archive/1/472890/100/0/threaded http://osvdb.org/38095 http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-internet-communication-manager-dos/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3635`	vulnerable	2026-06-08 04:48:41.464711	Details available Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application. Published: 2005-11-16T21:17:00.000Z Updated: 2024-08-07T23:17:23.402Z Open on db.gcve.eu Reference links http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf http://www.osvdb.org/20717 http://securityreason.com/securityalert/162 https://exchange.xforce.ibmcloud.com/vulnerabilities/23027 http://www.securityfocus.com/bid/15361	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3634`	vulnerable	2026-06-08 04:48:41.464245	Details available frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. Published: 2005-11-16T21:17:00.000Z Updated: 2024-08-07T23:17:23.318Z Open on db.gcve.eu Reference links http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/23031 http://www.securityfocus.com/bid/15362 http://securityreason.com/securityalert/163 http://marc.info/?l=bugtraq&m=113156525006667&w=2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3633`	vulnerable	2026-06-08 04:48:41.463692	Details available HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter. Published: 2005-11-16T21:17:00.000Z Updated: 2024-08-07T23:17:23.899Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=113156438708932&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/23030 http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf http://securityreason.com/securityalert/164 http://www.osvdb.org/20714	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.