CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-1929 20 DoS 2016-01-20 2016-01-22
8.5
None Remote Low Not required None Partial Complete
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted HTTP request, related to an unspecified debug function, aka SAP Security Note 2241978.
2 CVE-2016-1928 119 DoS Exec Code Overflow 2016-01-20 2016-01-22
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP request, related to JSON, aka SAP Security Note 2241978.
3 CVE-2016-1911 79 XSS 2016-01-15 2016-01-20
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) Runtime Workmench (RWB) or (2) Pmitest servlet in the Process Monitoring Infrastructure (PMI), aka SAP Security Note 2206793 and 2234918.
4 CVE-2016-1910 200 +Info 2016-01-15 2016-01-21
5.0
None Remote Low Not required Partial None None
The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290.
5 CVE-2015-8753 264 Bypass 2016-01-08 2016-01-12
9.4
None Remote Low Not required None Complete Complete
SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP Security Note 2134905.
6 CVE-2015-8600 264 +Priv Bypass +Info 2015-12-17 2015-12-18
7.5
None Remote Low Not required Partial Partial Partial
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855.
7 CVE-2015-8330 119 DoS Overflow Mem. Corr. 2015-11-24 2015-11-25
7.8
None Remote Low Not required None None Complete
The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.
8 CVE-2015-8329 310 2015-11-24 2015-11-27
5.0
None Remote Low Not required Partial None None
SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
9 CVE-2015-8030 119 Exec Code Overflow 2015-10-30 2015-11-02
6.8
None Remote Medium Not required Partial Partial Partial
SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D, (2) LWO, (3) JPEG2000, or (4) FBX file, aka "Out-Of-Bounds Indexing" vulnerabilities.
10 CVE-2015-8029 119 Exec Code Overflow Mem. Corr. 2015-10-30 2015-11-02
6.8
None Remote Medium Not required Partial Partial Partial
SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted Filmbox document, which triggers memory corruption.
11 CVE-2015-8028 119 Exec Code Overflow 2015-10-30 2015-11-02
6.8
None Remote Medium Not required Partial Partial Partial
Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or (2) Flic Animation file.
12 CVE-2015-7994 20 Exec Code 2015-11-10 2015-11-12
7.5
None Remote Low Not required Partial Partial Partial
The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428.
13 CVE-2015-7993 20 Exec Code 2015-11-10 2015-11-12
7.5
None Remote Low Not required Partial Partial Partial
The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397.
14 CVE-2015-7992 119 DoS Overflow Mem. Corr. 2015-11-10 2015-11-12
4.0
None Remote Low Single system None None Partial
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to the EXECUTE_SEARCH_RULE_SET stored procedure, aka SAP Security Note 2175928.
15 CVE-2015-7991 200 +Info 2015-11-10 2015-11-12
5.0
None Remote Low Not required Partial None None
The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854.
16 CVE-2015-7986 119 DoS Exec Code Overflow Mem. Corr. 2015-10-27 2016-02-02
7.5
None Remote Low Not required Partial Partial Partial
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428.
17 CVE-2015-7828 20 Exec Code 2015-11-10 2015-11-12
10.0
None Remote Low Not required Complete Complete Complete
SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the (1) fcopydir, (2) fmkdir, (3) frmdir, (4) getenv, (5) dumpenv, (6) fcopy, (7) fput, (8) fdel, (9) fmove, (10) fget, (11) fappend, (12) fdir, (13) getTraces, (14) kill, (15) pexec, (16) stop, or (17) pythonexec method, aka SAP Security Note 2165583.
18 CVE-2015-7239 89 Exec Code Sql 2015-09-18 2015-09-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
19 CVE-2015-6664 2015-08-24 2015-08-25
6.8
None Remote Medium Not required Partial Partial Partial
XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227.
20 CVE-2015-6663 79 XSS 2015-08-24 2015-08-25
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.
21 CVE-2015-6662 2015-08-24 2015-08-25
6.8
None Remote Medium Not required Partial Partial Partial
XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
22 CVE-2015-5068 2015-06-24 2015-09-17
7.5
None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601.
23 CVE-2015-5067 255 2015-06-24 2015-09-17
7.5
None Remote Low Not required Partial Partial Partial
The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Note 2059659 and 2057982.
24 CVE-2015-4161 264 +Priv +Info 2015-06-02 2015-06-03
7.5
None Remote Low Not required Partial Partial Partial
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
25 CVE-2015-4160 89 Exec Code Sql 2015-06-02 2015-06-03
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278.
26 CVE-2015-4159 89 Exec Code Sql 2015-06-02 2015-06-03
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 2153892.
27 CVE-2015-4158 DoS 2015-06-02 2015-06-03
5.0
None Remote Low Not required None None Partial
SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
28 CVE-2015-4157 DoS 2015-06-02 2015-06-03
5.0
None Remote Low Not required None None Partial
SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
29 CVE-2015-4092 119 DoS Exec Code Overflow 2015-05-26 2015-09-10
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
30 CVE-2015-4091 2015-05-26 2015-09-10
7.5
None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851.
31 CVE-2015-3995 200 +Info 2015-05-29 2015-06-02
4.0
None Remote Low Single system Partial None None
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565.
32 CVE-2015-3994 20 2015-05-29 2015-06-01
4.0
None Remote Low Single system None Partial None
The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818.
33 CVE-2015-3981 200 +Info 2015-05-12 2015-05-14
5.0
None Remote Low Not required Partial None None
SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037.
34 CVE-2015-3980 89 Exec Code Sql 2015-05-12 2015-05-13
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.
35 CVE-2015-3979 Exec Code 2015-05-12 2015-05-13
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
36 CVE-2015-3978 200 +Info 2015-05-12 2015-05-14
2.1
None Local Low Not required Partial None None
SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830.
37 CVE-2015-3621 20 +Priv 2015-07-16 2015-07-21
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse program.
38 CVE-2015-3449 254 +Priv 2015-07-16 2015-07-21
7.2
None Local Low Not required Complete Complete Complete
The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.
39 CVE-2015-2820 119 DoS Overflow 2015-04-01 2015-04-01
5.0
None Remote Low Not required None None Partial
Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.
40 CVE-2015-2819 20 DoS 2015-04-01 2015-05-15
5.0
None Remote Low Not required None None Partial
SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service (crash) via a crafted request, aka SAP Security Note 2108161.
41 CVE-2015-2818 2015-04-01 2015-04-01
5.0
None Remote Low Not required None Partial None
XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125513.
42 CVE-2015-2817 200 +Info 2015-04-01 2015-04-02
5.0
None Remote Low Not required Partial None None
The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
43 CVE-2015-2816 284 2015-04-01 2015-04-02
7.5
None Remote Low Not required Partial Partial Partial
The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, which allows remote attackers to have unspecified impact via a crafted request, aka SAP Security Note 2134905.
44 CVE-2015-2815 119 DoS Exec Code Overflow 2015-04-01 2015-04-02
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2063369.
45 CVE-2015-2814 264 2015-04-01 2015-04-02
6.4
None Remote Low Not required None Partial Partial
SAP EMR Unwired (com.sap.mobile.healthcare.emr.v2) and Clinical Task Tracker (com.sap.mobile.healthcare.ctt) does not properly restrict access, which allows remote attackers to change the backendurl, clientid, ssourl, and infopageurl settings via unspecified vectors, aka SAP Security Note 2117079.
46 CVE-2015-2813 2015-04-01 2015-04-02
5.0
None Remote Low Not required None Partial None
XML external entity (XXE) vulnerability in SAP Mobile Platform allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2125358.
47 CVE-2015-2812 2015-04-01 2015-04-02
5.0
None Remote Low Not required None Partial None
XML external entity (XXE) vulnerability in XMLValidationComponent in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2093966.
48 CVE-2015-2811 2015-04-01 2015-04-02
5.0
None Remote Low Not required None Partial None
XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2111939.
49 CVE-2015-2282 119 DoS Exec Code Overflow 2015-06-02 2015-06-03
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
50 CVE-2015-2278 119 DoS Overflow 2015-06-02 2015-06-03
5.0
None Remote Low Not required None None Partial
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
Total number of vulnerabilities : 276   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.