SAP NetWeaver Abap Application Server vulnerabilities

5 CVEs affecting SAP NetWeaver Abap Application Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-47586, published 2024-11-12.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-47586, published 2024-11-12. Medium severity, CVSS 5.3. EPSS: 3.5% chance of exploitation in the next 30 days. SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel.…
• CVE-2015-2282, published 2015-06-02. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver…
• CVE-2015-2278, published 2015-06-02. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver…
• CVE-2015-4158, published 2015-06-02. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
• CVE-2014-3130, published 2014-04-30. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. The ABAP Help documentation and translation tools (BC-DOC-HLP) in Basis in SAP Netweaver ABAP Application Server does not properly restrict access, which allows local users to gain privileges and…