[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWnV6lT91-Of253arPJPVXuB7TdWCoRALDFoLQF3TdZM":3,"g5a-ex:sap\u002Fsap_web_application_server@*":120,"g5a-family:sap\u002Fsap_web_application_server":122},{"success":4,"data":5},true,{"product":6,"versions":35,"topVulnerabilitiesByEpss":43,"kevVulnerabilities":97,"seoMetadata":98,"meta":117},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":34},"sap","sap_web_application_server",7,12,0,"2010-01-12",[14,18,21,24,27,29,32],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"6.0",1,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},"6.10",6,{"version":22,"cve_count":23,"kev_count":11,"has_kev":17},"6.20",5,{"version":25,"cve_count":26,"kev_count":11,"has_kev":17},"6.40",8,{"version":28,"cve_count":23,"kev_count":11,"has_kev":17},"7.0",{"version":30,"cve_count":31,"kev_count":11,"has_kev":17},"7.00",2,{"version":33,"cve_count":16,"kev_count":11,"has_kev":17},"7.0.10","Sap Web Application Server by Sap is a technology product with 7 tracked versions and 12 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[36,37,38,39,40,41,42],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},{"version":22,"cve_count":23,"kev_count":11,"has_kev":17},{"version":25,"cve_count":26,"kev_count":11,"has_kev":17},{"version":28,"cve_count":23,"kev_count":11,"has_kev":17},{"version":30,"cve_count":31,"kev_count":11,"has_kev":17},{"version":33,"cve_count":16,"kev_count":11,"has_kev":17},[44,51,56,61,65,71,77,84,88,93],{"cveId":45,"description":46,"publishedDate":47,"cvssScore":23,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":50},"CVE-2005-3634","frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.","2005-11-16","v2","Medium",0.17757,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":23,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":55},"CVE-2006-6010","SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.","2006-11-21",0.13923,{"cveId":57,"description":58,"publishedDate":47,"cvssScore":59,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":60},"CVE-2005-3636","Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages.",4.3,0.05054,{"cveId":62,"description":63,"publishedDate":47,"cvssScore":59,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":64},"CVE-2005-3635","Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application.",0.05031,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":69,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":70},"CVE-2006-5784","Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted data on a \"3200+SYSNR\" TCP port, as demonstrated by port 3201. NOTE: this issue can be leveraged by local users to access a named pipe as the SAPServiceJ2E user.","2006-11-07",4.6,0.02924,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":75,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":76},"CVE-2006-1039","SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a \";%20\" followed by encoded HTTP headers.","2006-03-07",6.4,0.02738,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":48,"severity":82,"isKev":17,"epssScore":83},"CVE-2007-3615","Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web cache.","2007-07-06",7.8,"High",0.02354,{"cveId":85,"description":86,"publishedDate":47,"cvssScore":23,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":87},"CVE-2005-3633","HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.",0.02047,{"cveId":89,"description":90,"publishedDate":91,"cvssScore":59,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":92},"CVE-2008-2421","Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc\u002Fgui\u002Fsap\u002Fits\u002Fwebgui\u002F.","2008-05-23",0.01826,{"cveId":94,"description":95,"publishedDate":68,"cvssScore":23,"cvssVersion":48,"severity":49,"isKev":17,"epssScore":96},"CVE-2006-5785","Unspecified vulnerability in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to cause a denial of service (enserver.exe crash) via a 0x72F2 sequence on UDP port 64999.",0.01822,[],{"title":99,"metaDescription":100,"keywords":101,"structuredData":102},"Sap Web Application Server by Sap - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Sap Web Application Server by Sap covering 7 versions with 12 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Sap Web Application Server vulnerabilities, Sap Web Application Server security, Sap Web Application Server CVE, Sap Sap Web Application Server, Sap Web Application Server threat intelligence, Sap security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":103,"@type":104,"name":105,"description":100,"url":106,"manufacturer":107,"applicationCategory":111,"softwareVersion":112,"mainEntity":113},"https:\u002F\u002Fschema.org","SoftwareApplication","Sap Web Application Server","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fsap\u002Fsap_web_application_server",{"@type":108,"name":109,"url":110},"Organization","Sap","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsap","Security Software","7 versions tracked",{"@type":114,"name":115,"description":116,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Sap Web Application Server Security Vulnerabilities","Security vulnerabilities affecting Sap Web Application Server by Sap",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":118,"apiVersion":119},"2026-10-17T18:25:31.621Z","3.0",{"rows":121,"total":11,"capped":17,"failed":11},[],[]]