CVE-2015-6662

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-66634.3Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject a CVE-2015-66646.8XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read a CVE-2015-66654.3Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Dru CVE-2015-66687.5The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload dir CVE-2015-66704.0ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote CVE-2015-66715.9Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-depe CVE-2015-66724.3Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and N CVE-2015-66739.8Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.CVE-2015-66749.8Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE:CVE-2015-66754.3Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isol CVE-2015-667610.0Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Ado CVE-2015-667710.0Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.