Sap Netweaver_application_server_java
69 CVEs affecting Sap Netweaver_application_server_java. Latest disclosed: 2026-04-14. Critical: 11, High: 20.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26829 | Critical | 10.0 | 2020-12-09 | SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missin… |
CVE-2020-6287 | Critical | 10.0 | 2020-07-14 | SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p… |
CVE-2010-5326 | Critical | 10.0 | 2016-05-13 | The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to… |
CVE-2023-40309 | Critical | 9.8 | 2023-09-12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resu… |
CVE-2022-22532 | Critical | 9.8 | 2022-02-09 | In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthentic… |
CVE-2021-37535 | Critical | 9.8 | 2021-09-14 | SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks fo… |
CVE-2020-6263 | Critical | 9.8 | 2020-06-10 | Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CO… |
CVE-2019-0345 | Critical | 9.8 | 2019-08-14 | A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7… |
CVE-2016-2386 | Critical | 9.8 | 2016-02-16 | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vect… |
CVE-2024-22127 | Critical | 9.1 | 2024-03-12 | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous… |
CVE-2016-3974 | Critical | 9.1 | 2016-04-07 | XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of servi… |
CVE-2019-0389 | High | 8.8 | 2019-11-13 | An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for al… |
CVE-2017-8913 | High | 8.8 | 2017-05-23 | The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a cra… |
CVE-2017-7717 | High | 8.8 | 2017-04-14 | SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execut… |
CVE-2015-8840 | High | 8.8 | 2016-04-08 | The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive inf… |
CVE-2024-24743 | High | 8.6 | 2024-02-13 | SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over t… |
CVE-2024-34688 | High | 7.5 | 2024-06-11 | Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prev… |
CVE-2023-40308 | High | 7.5 | 2023-09-12 | SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library w… |
CVE-2022-22533 | High | 7.5 | 2022-02-09 | Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7… |
CVE-2021-33670 | High | 7.5 | 2021-07-14 | SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP reque… |