[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU2chUi7hALK7CnITWCErnrH4T8cg6L5id5q8wghYkFI":3,"g5a-family:sap\u002Fnetweaver_application_server_java":269,"g5a-ex:sap\u002Fnetweaver_application_server_java@*":270},{"success":4,"data":5},true,{"product":6,"versions":117,"topVulnerabilitiesByEpss":163,"kevVulnerabilities":221,"seoMetadata":247,"meta":266},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":116},"sap","netweaver_application_server_java",45,67,7,"2025-09-09",[14,19,22,24,26,28,31,34,36,39,41,44,46,49,52,54,57,59,61,63,66,68,70,72,74,76,78,80,82,84,86,88,90,92,94,96,98,100,102,104,106,108,110,112,114],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"7.00",2,0,false,{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},"7.01",1,{"version":23,"cve_count":21,"kev_count":17,"has_kev":18},"7.02",{"version":25,"cve_count":21,"kev_count":17,"has_kev":18},"7.05",{"version":27,"cve_count":21,"kev_count":17,"has_kev":18},"7.1",{"version":29,"cve_count":30,"kev_count":17,"has_kev":18},"7.10",19,{"version":32,"cve_count":33,"kev_count":17,"has_kev":18},"7.11",16,{"version":35,"cve_count":21,"kev_count":17,"has_kev":18},"7.2",{"version":37,"cve_count":38,"kev_count":17,"has_kev":18},"7.20",24,{"version":40,"cve_count":21,"kev_count":17,"has_kev":18},"7.21",{"version":42,"cve_count":43,"kev_count":17,"has_kev":18},"7.22",3,{"version":45,"cve_count":21,"kev_count":17,"has_kev":18},"7.3",{"version":47,"cve_count":48,"kev_count":21,"has_kev":4},"7.30",31,{"version":50,"cve_count":51,"kev_count":21,"has_kev":4},"7.31",33,{"version":53,"cve_count":21,"kev_count":17,"has_kev":18},"7.4",{"version":55,"cve_count":56,"kev_count":16,"has_kev":4},"7.40",35,{"version":58,"cve_count":21,"kev_count":17,"has_kev":18},"7.45",{"version":60,"cve_count":43,"kev_count":17,"has_kev":18},"7.49",{"version":62,"cve_count":16,"kev_count":17,"has_kev":18},"7.5",{"version":64,"cve_count":65,"kev_count":43,"has_kev":4},"7.50",46,{"version":67,"cve_count":43,"kev_count":17,"has_kev":18},"7.53",{"version":69,"cve_count":21,"kev_count":17,"has_kev":18},"gp-core_7.5",{"version":71,"cve_count":16,"kev_count":17,"has_kev":18},"kernel64nuc_7.22",{"version":73,"cve_count":16,"kev_count":17,"has_kev":18},"kernel64nuc_7.22ext",{"version":75,"cve_count":16,"kev_count":17,"has_kev":18},"kernel64uc_7.22",{"version":77,"cve_count":16,"kev_count":17,"has_kev":18},"kernel64uc_7.22ext",{"version":79,"cve_count":16,"kev_count":17,"has_kev":18},"kernel64uc_7.53",{"version":81,"cve_count":16,"kev_count":17,"has_kev":18},"kernel64uc_8.04",{"version":83,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.22",{"version":85,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.53",{"version":87,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.54",{"version":89,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.77",{"version":91,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.85",{"version":93,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.89",{"version":95,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.91",{"version":97,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.92",{"version":99,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_7.93",{"version":101,"cve_count":16,"kev_count":17,"has_kev":18},"kernel_8.04",{"version":103,"cve_count":16,"kev_count":17,"has_kev":18},"krnl64nuc_7.22",{"version":105,"cve_count":16,"kev_count":17,"has_kev":18},"krnl64nuc_7.22ext",{"version":107,"cve_count":16,"kev_count":17,"has_kev":18},"krnl64nuc_7.49",{"version":109,"cve_count":16,"kev_count":17,"has_kev":18},"krnl64uc_7.22",{"version":111,"cve_count":16,"kev_count":17,"has_kev":18},"krnl64uc_7.22ext",{"version":113,"cve_count":16,"kev_count":17,"has_kev":18},"krnl64uc_7.49",{"version":115,"cve_count":21,"kev_count":17,"has_kev":18},"mmr_server_7.5","Netweaver Application Server Java by Sap is a technology product with 45 tracked versions and 67 known security vulnerabilities including 7 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},{"version":23,"cve_count":21,"kev_count":17,"has_kev":18},{"version":25,"cve_count":21,"kev_count":17,"has_kev":18},{"version":27,"cve_count":21,"kev_count":17,"has_kev":18},{"version":29,"cve_count":30,"kev_count":17,"has_kev":18},{"version":32,"cve_count":33,"kev_count":17,"has_kev":18},{"version":35,"cve_count":21,"kev_count":17,"has_kev":18},{"version":37,"cve_count":38,"kev_count":17,"has_kev":18},{"version":40,"cve_count":21,"kev_count":17,"has_kev":18},{"version":42,"cve_count":43,"kev_count":17,"has_kev":18},{"version":45,"cve_count":21,"kev_count":17,"has_kev":18},{"version":47,"cve_count":48,"kev_count":21,"has_kev":4},{"version":50,"cve_count":51,"kev_count":21,"has_kev":4},{"version":53,"cve_count":21,"kev_count":17,"has_kev":18},{"version":55,"cve_count":56,"kev_count":16,"has_kev":4},{"version":58,"cve_count":21,"kev_count":17,"has_kev":18},{"version":60,"cve_count":43,"kev_count":17,"has_kev":18},{"version":62,"cve_count":16,"kev_count":17,"has_kev":18},{"version":64,"cve_count":65,"kev_count":43,"has_kev":4},{"version":67,"cve_count":43,"kev_count":17,"has_kev":18},{"version":69,"cve_count":21,"kev_count":17,"has_kev":18},{"version":71,"cve_count":16,"kev_count":17,"has_kev":18},{"version":73,"cve_count":16,"kev_count":17,"has_kev":18},{"version":75,"cve_count":16,"kev_count":17,"has_kev":18},{"version":77,"cve_count":16,"kev_count":17,"has_kev":18},{"version":79,"cve_count":16,"kev_count":17,"has_kev":18},{"version":81,"cve_count":16,"kev_count":17,"has_kev":18},{"version":83,"cve_count":16,"kev_count":17,"has_kev":18},{"version":85,"cve_count":16,"kev_count":17,"has_kev":18},{"version":87,"cve_count":16,"kev_count":17,"has_kev":18},{"version":89,"cve_count":16,"kev_count":17,"has_kev":18},{"version":91,"cve_count":16,"kev_count":17,"has_kev":18},{"version":93,"cve_count":16,"kev_count":17,"has_kev":18},{"version":95,"cve_count":16,"kev_count":17,"has_kev":18},{"version":97,"cve_count":16,"kev_count":17,"has_kev":18},{"version":99,"cve_count":16,"kev_count":17,"has_kev":18},{"version":101,"cve_count":16,"kev_count":17,"has_kev":18},{"version":103,"cve_count":16,"kev_count":17,"has_kev":18},{"version":105,"cve_count":16,"kev_count":17,"has_kev":18},{"version":107,"cve_count":16,"kev_count":17,"has_kev":18},{"version":109,"cve_count":16,"kev_count":17,"has_kev":18},{"version":111,"cve_count":16,"kev_count":17,"has_kev":18},{"version":113,"cve_count":16,"kev_count":17,"has_kev":18},{"version":115,"cve_count":21,"kev_count":17,"has_kev":18},[164,172,179,185,191,196,200,206,211,216],{"cveId":165,"description":166,"publishedDate":167,"cvssScore":168,"cvssVersion":169,"severity":170,"isKev":4,"epssScore":171},"CVE-2017-12637","Directory traversal vulnerability in scheduler\u002Fui\u002Fjs\u002Fffffffffbca41eb4\u002FUIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.","2017-08-07",7.5,"v3.1","High",0.95111,{"cveId":173,"description":174,"publishedDate":175,"cvssScore":176,"cvssVersion":169,"severity":177,"isKev":4,"epssScore":178},"CVE-2020-6287","SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.","2020-07-14",10,"Critical",0.94719,{"cveId":180,"description":181,"publishedDate":182,"cvssScore":183,"cvssVersion":169,"severity":177,"isKev":4,"epssScore":184},"CVE-2016-2386","SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.","2016-02-16",9.8,0.71522,{"cveId":186,"description":187,"publishedDate":182,"cvssScore":188,"cvssVersion":169,"severity":189,"isKev":4,"epssScore":190},"CVE-2016-2388","The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.",5.3,"Medium",0.52206,{"cveId":192,"description":193,"publishedDate":194,"cvssScore":168,"cvssVersion":169,"severity":170,"isKev":4,"epssScore":195},"CVE-2016-3976","Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.","2016-04-07",0.47252,{"cveId":197,"description":198,"publishedDate":175,"cvssScore":188,"cvssVersion":169,"severity":189,"isKev":18,"epssScore":199},"CVE-2020-6286","The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.",0.28312,{"cveId":201,"description":202,"publishedDate":203,"cvssScore":204,"cvssVersion":169,"severity":189,"isKev":4,"epssScore":205},"CVE-2016-9563","BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web\u002Fbpemuwlconn URI, aka SAP Security Note 2296909.","2016-11-23",6.5,0.24226,{"cveId":207,"description":208,"publishedDate":209,"cvssScore":176,"cvssVersion":169,"severity":177,"isKev":4,"epssScore":210},"CVE-2010-5326","The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a \"Detour\" attack.","2016-05-13",0.1777,{"cveId":212,"description":213,"publishedDate":194,"cvssScore":214,"cvssVersion":169,"severity":177,"isKev":18,"epssScore":215},"CVE-2016-3974","XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web\u002FServerNodesWSService, aka SAP Security Note 2235994.",9.1,0.15058,{"cveId":217,"description":218,"publishedDate":219,"cvssScore":176,"cvssVersion":169,"severity":177,"isKev":18,"epssScore":220},"CVE-2020-26829","SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely.","2020-12-09",0.04765,[222,227,232,235,239,241,244],{"cveId":165,"description":166,"publishedDate":167,"cvssScore":168,"severity":170,"isKev":4,"epssScore":171,"cisaVulnName":223,"cisaDateAdded":224,"cisaShortDescription":225,"cisaRequiredAction":226},"SAP NetWeaver Directory Traversal Vulnerability","2025-03-19","SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler\u002Fui\u002Fjs\u002Fffffffffbca41eb4\u002FUIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":186,"description":187,"publishedDate":182,"cvssScore":188,"severity":189,"isKev":4,"epssScore":190,"cisaVulnName":228,"cisaDateAdded":229,"cisaShortDescription":230,"cisaRequiredAction":231},"SAP NetWeaver Information Disclosure Vulnerability","2022-06-09","The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.","Apply updates per vendor instructions.",{"cveId":180,"description":181,"publishedDate":182,"cvssScore":183,"severity":177,"isKev":4,"epssScore":184,"cisaVulnName":233,"cisaDateAdded":229,"cisaShortDescription":234,"cisaRequiredAction":231},"SAP NetWeaver SQL Injection Vulnerability","SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",{"cveId":173,"description":174,"publishedDate":175,"cvssScore":176,"severity":177,"isKev":4,"epssScore":178,"cisaVulnName":236,"cisaDateAdded":237,"cisaShortDescription":238,"cisaRequiredAction":231},"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","2021-11-03","SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.",{"cveId":192,"description":193,"publishedDate":194,"cvssScore":168,"severity":170,"isKev":4,"epssScore":195,"cisaVulnName":223,"cisaDateAdded":237,"cisaShortDescription":240,"cisaRequiredAction":231},"SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.",{"cveId":207,"description":208,"publishedDate":209,"cvssScore":176,"severity":177,"isKev":4,"epssScore":210,"cisaVulnName":242,"cisaDateAdded":237,"cisaShortDescription":243,"cisaRequiredAction":231},"SAP NetWeaver Remote Code Execution Vulnerability","SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.",{"cveId":201,"description":202,"publishedDate":203,"cvssScore":204,"severity":189,"isKev":4,"epssScore":205,"cisaVulnName":245,"cisaDateAdded":237,"cisaShortDescription":246,"cisaRequiredAction":231},"SAP NetWeaver XML External Entity (XXE) Vulnerability","SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.",{"title":248,"metaDescription":249,"keywords":250,"structuredData":251},"Netweaver Application Server Java by Sap - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Netweaver Application Server Java by Sap covering 45 versions with 67 tracked vulnerabilities including 3 critical and 2 high-severity issues and 7 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Netweaver Application Server Java vulnerabilities, Netweaver Application Server Java security, Netweaver Application Server Java CVE, Sap Netweaver Application Server Java, Netweaver Application Server Java threat intelligence, Sap security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Netweaver Application Server Java KEV, Netweaver Application Server Java exploited vulnerabilities",{"@context":252,"@type":253,"name":254,"description":249,"url":255,"manufacturer":256,"applicationCategory":260,"softwareVersion":261,"mainEntity":262},"https:\u002F\u002Fschema.org","SoftwareApplication","Netweaver Application Server Java","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fsap\u002Fnetweaver_application_server_java",{"@type":257,"name":258,"url":259},"Organization","Sap","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsap","Security Software","45 versions tracked",{"@type":263,"name":264,"description":265,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Netweaver Application Server Java Security Vulnerabilities","Security vulnerabilities affecting Netweaver Application Server Java by Sap",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":267,"apiVersion":268},"2026-10-17T21:15:33.481Z","3.0",[],{"rows":271,"total":11,"capped":18,"failed":17},[272,276,281,285,289,293,298],{"cveId":165,"name":223,"severity":170,"cvss":168,"added":224,"epss":171,"published":273,"ranges":274,"checked":4,"hits":275,"covers":18},"2017-08-07T20:29:01.12",[64],[],{"cveId":186,"name":228,"severity":189,"cvss":188,"added":229,"epss":190,"published":277,"ranges":278,"checked":4,"hits":280,"covers":18},"2016-02-16T15:59:02.103",[279],"7.10 to 7.50",[],{"cveId":180,"name":233,"severity":177,"cvss":183,"added":229,"epss":184,"published":282,"ranges":283,"checked":4,"hits":284,"covers":18},"2016-02-16T15:59:00.133",[55],[],{"cveId":173,"name":236,"severity":177,"cvss":176,"added":237,"epss":178,"published":286,"ranges":287,"checked":4,"hits":288,"covers":18},"2020-07-14T13:15:13",[47,50,55,64],[],{"cveId":192,"name":223,"severity":170,"cvss":168,"added":237,"epss":195,"published":290,"ranges":291,"checked":4,"hits":292,"covers":18},"2016-04-07T23:59:10.797",[279],[],{"cveId":207,"name":242,"severity":177,"cvss":176,"added":237,"epss":210,"published":294,"ranges":295,"checked":4,"hits":297,"covers":18},"2016-05-13T10:59:00.173",[296],"up to 7.30",[],{"cveId":201,"name":245,"severity":189,"cvss":204,"added":237,"epss":205,"published":299,"ranges":300,"checked":4,"hits":301,"covers":18},"2016-11-23T02:59:06.37",[64],[]]