GCVE - cpe:2.3:a:sap:netweaver:7.11:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sap:netweaver:7.11:*:*:*:*:*:*:*

part: a version: 7.11 update: *

Vendor	Sap (`dd5aa0c0-20b0-5c86-a937-aa29f1a33b77`)
Product	Netweaver (`27ebb32b-037e-5ce8-844e-70d059f1f917`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21481`	vulnerable	2026-06-08 05:29:12.115220	Details available CRITICAL (9.6) The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in complete compromise of system confidentiality, integrity, and availability. Published: 2021-03-09T14:05:51.000Z Updated: 2024-08-03T18:16:22.540Z Open on db.gcve.eu Reference links https://launchpad.support.sap.com/#/notes/3022422 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-6285`	vulnerable	2026-06-08 05:26:45.006476	Details available HIGH (7.7) SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Published: 2020-07-14T12:30:14.000Z Updated: 2024-08-04T08:55:22.414Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 https://launchpad.support.sap.com/#/notes/2932473	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-6203`	vulnerable	2026-06-08 05:26:44.717750	Details available CRITICAL (9.1) SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal. Published: 2020-03-10T20:20:04.000Z Updated: 2024-08-04T08:55:21.879Z Open on db.gcve.eu Reference links https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 https://launchpad.support.sap.com/#/notes/2806198	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1965`	vulnerable	2026-06-08 05:05:26.944173	Details available Cross-site scripting (XSS) vulnerability in ISpeakAdapter in the Integration Repository in the SAP Exchange Infrastructure (BC-XI) component 3.0, 7.00 through 7.02, and 7.10 through 7.11 for SAP NetWeaver allows remote attackers to inject arbitrary web script or HTML via vectors related to PIP. Published: 2014-02-14T15:00:00.000Z Updated: 2024-08-06T09:58:15.787Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/91094 http://secunia.com/advisories/56947 https://erpscan.io/advisories/erpscan-14-006-sap-netweaver-pip-xss/ https://service.sap.com/sap/support/notes/1442517 http://www.stechno.net/sap-notes.html?view=sapnote&id=1442517	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.