CVE-2017-14581

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-145825.9The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which alloCVE-2017-145836.5NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a DeCVE-2017-145857.2A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was intrCVE-2017-145869.8The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop cCVE-2017-145875.4The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitraryCVE-2017-145886.1Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via aCVE-2017-145899.6It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted aCVE-2017-14594.2IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resouCVE-2017-145909.1Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to crCVE-2017-145919.0Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in MercuriaCVE-2017-145928.8Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission tCVE-2017-145938.8Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission
CVE-2017-14581: High severity, CVSS 7.5 | Vulnix