CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

SAP : Security Vulnerabilities (Denial Of Service)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-14581 400 DoS 2017-09-19 2017-10-03
5.0
None Remote Low Not required None None Partial
The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security Note 2389181.
2 CVE-2017-9845 400 DoS 2017-07-12 2017-07-21
7.8
None Remote Low Not required None None Complete
disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918.
3 CVE-2017-9844 502 DoS Exec Code 2017-07-12 2017-07-21
7.5
None Remote Low Not required Partial Partial Partial
SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804.
4 CVE-2017-9843 264 DoS 2017-07-12 2017-07-20
4.0
None Remote Low Single system None None Partial
SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP Security Note 2406841.
5 CVE-2017-8915 20 DoS 2017-05-23 2017-06-08
5.0
None Remote Low Not required None None Partial
sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to cause a denial of service (assertion failure and service crash) by pushing a package with a filename containing a $ (dollar sign) or % (percent) character, aka SAP Security Note 2407694.
6 CVE-2017-7696 399 DoS 2017-04-14 2017-04-25
5.0
None Remote Low Not required None None Partial
SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_resources/qr, aka SAP Security Note 2389042.
7 CVE-2017-5997 399 DoS 2017-02-15 2017-02-23
5.0
None Remote Low Not required None None Partial
The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple msgserver/group?group= requests with a crafted size of the group parameter, aka SAP Security Note 2358972.
8 CVE-2016-10311 119 DoS Overflow 2017-04-10 2017-04-18
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by sending a crafted packet to the SAPSTARTSRV port, aka SAP Security Note 2295238.
9 CVE-2016-10310 119 DoS Overflow 2017-04-10 2017-04-14
4.0
None Remote Low Single system None None Partial
Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated users to cause a denial of service (resource consumption and process crash) by sending a crafted packet several times, aka SAP Security Note 2308778.
10 CVE-2016-10304 502 DoS 2017-04-10 2017-04-14
4.0
None Remote Low Single system None None Partial
The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788.
11 CVE-2016-10079 20 DoS 2017-02-01 2017-02-27
5.0
None Remote Low Not required None None Partial
SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port 515.
12 CVE-2016-9562 476 DoS 2016-11-22 2017-01-12
5.0
None Remote Low Not required None None Partial
SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835.
13 CVE-2016-6818 89 DoS Sql +Info 2017-04-13 2017-04-20
10.0
None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information, modify data, cause a denial of service (data deletion), or launch administrative operations or possibly OS commands via a crafted SQL query. The vendor response is SAP Security Note 2361633.
14 CVE-2016-6148 20 DoS Exec Code 2016-08-05 2016-11-28
5.0
None Remote Low Not required None None Partial
SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IMPORT statement, aka SAP Security Note 2233136.
15 CVE-2016-5845 DoS 2016-08-12 2016-11-28
2.1
None Local Low Not required None None Partial
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive file, aka SAP Security Note 2312905.
16 CVE-2016-4017 DoS 2016-04-14 2016-04-20
5.0
None Remote Low Not required None None Partial
The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP Security Note 2262710.
17 CVE-2016-4015 DoS 2016-04-14 2016-04-19
5.0
None Remote Low Not required None None Partial
The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request, aka SAP Security Note 2258784.
18 CVE-2016-4014 DoS 2016-04-14 2016-08-15
9.0
User Remote Low Not required Partial Partial Complete
XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389.
19 CVE-2016-3980 20 DoS 2016-04-08 2016-11-29
5.0
None Remote Low Not required None None Partial
The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request, aka SAP Security Note 2259547.
20 CVE-2016-3979 20 DoS Mem. Corr. 2016-04-08 2016-11-29
5.0
None Remote Low Not required None None Partial
Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap memory corruption and process crash) via a crafted HTTP request, related to the IctParseCookies function, aka SAP Security Note 2256185.
21 CVE-2016-3974 DoS 2016-04-07 2016-11-29
7.5
None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.
22 CVE-2016-3638 119 DoS Overflow Mem. Corr. 2016-10-13 2016-10-14
2.1
None Local Low Not required None None Partial
SAP SLD Registration Program (aka SLDREG) allows local users to cause a denial of service (memory corruption and process termination) via a crafted HOST parameter, aka SAP Security Note 2125623.
23 CVE-2016-1929 20 DoS 2016-01-20 2016-12-02
8.5
None Remote Low Not required None Partial Complete
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted HTTP request, related to an unspecified debug function, aka SAP Security Note 2241978.
24 CVE-2016-1928 119 DoS Exec Code Overflow 2016-01-20 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP request, related to JSON, aka SAP Security Note 2241978.
25 CVE-2015-8330 119 DoS Overflow Mem. Corr. 2015-11-24 2016-12-05
7.8
None Remote Low Not required None None Complete
The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619.
26 CVE-2015-7992 119 DoS Overflow Mem. Corr. 2015-11-10 2015-11-12
4.0
None Remote Low Single system None None Partial
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to the EXECUTE_SEARCH_RULE_SET stored procedure, aka SAP Security Note 2175928.
27 CVE-2015-7986 119 DoS Exec Code Overflow Mem. Corr. 2015-10-27 2017-09-09
7.5
None Remote Low Not required Partial Partial Partial
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428.
28 CVE-2015-4158 DoS 2015-06-02 2016-11-28
5.0
None Remote Low Not required None None Partial
SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
29 CVE-2015-4157 DoS 2015-06-02 2016-11-28
5.0
None Remote Low Not required None None Partial
SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
30 CVE-2015-4092 119 DoS Exec Code Overflow 2015-05-26 2015-09-10
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
31 CVE-2015-2820 119 DoS Overflow 2015-04-01 2016-12-02
5.0
None Remote Low Not required None None Partial
Buffer overflow in XcListener in SAP Afaria 7.0.6001.5 allows remote attackers to cause a denial of service (process termination) via a crafted request, aka SAP Security Note 2132584.
32 CVE-2015-2819 20 DoS 2015-04-01 2016-12-02
5.0
None Remote Low Not required None None Partial
SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service (crash) via a crafted request, aka SAP Security Note 2108161.
33 CVE-2015-2815 119 DoS Exec Code Overflow 2015-04-01 2016-12-02
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in the C_SAPGPARAM function in the NetWeaver Dispatcher in SAP KERNEL 7.00 (7000.52.12.34966) and 7.40 (7400.12.21.30308) allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2063369.
34 CVE-2015-2282 119 DoS Exec Code Overflow 2015-06-02 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
35 CVE-2015-2278 119 DoS Overflow 2015-06-02 2016-12-02
5.0
None Remote Low Not required None None Partial
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.
36 CVE-2014-9595 119 DoS Exec Code Overflow 2015-01-15 2015-01-16
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the Spool System, aka SAP Note 2061271.
37 CVE-2014-9594 119 DoS Exec Code Overflow 2015-01-15 2015-01-16
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via unspecified vectors, related to the ABAP VM, aka SAP Note 2059734.
38 CVE-2014-8662 DoS 2014-11-06 2014-11-06
7.8
None Remote Low Not required None None Complete
Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling.
39 CVE-2014-8592 DoS 2014-11-04 2015-11-04
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in SAP Host Agent, as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via a crafted request.
40 CVE-2014-8591 DoS 2014-11-04 2017-09-07
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in SAP Internet Communication Manager (ICM), as used in SAP NetWeaver 7.02 and 7.3, allows remote attackers to cause a denial of service (process termination) via unknown vectors.
41 CVE-2014-8589 189 DoS Overflow 2014-11-04 2015-11-25
5.0
None Remote Low Not required None None Partial
Integer overflow in SAP Network Interface Router (SAProuter) 40.4 allows remote attackers to cause a denial of service (resource consumption) via crafted requests.
42 CVE-2014-8310 20 DoS 2014-10-16 2017-09-07
7.1
None Remote Medium Not required None None Complete
The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.
43 CVE-2014-6252 119 DoS Exec Code Overflow 2014-09-05 2017-09-07
6.5
None Remote Low Single system Partial Partial Partial
Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors.
44 CVE-2014-1963 DoS 2014-02-14 2017-08-28
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in Message Server in SAP NetWeaver 7.20 allows remote attackers to cause a denial of service via unknown attack vectors.
45 CVE-2014-0995 20 DoS 2014-11-06 2017-08-28
5.0
None Remote Low Not required None None Partial
The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion and crash) via a trace level with a wildcard in the Trace Pattern.
46 CVE-2013-7366 287 DoS 2014-04-10 2014-04-11
5.0
None Remote Low Not required None None Partial
The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications.
47 CVE-2013-6817 119 DoS Exec Code Overflow 2013-11-20 2013-11-20
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in SAP Network Interface Router (SAProuter) 7.30 allows remote attackers to cause a denial of service and execute arbitrary code via crafted NI Route messages.
48 CVE-2013-6815 20 DoS 2013-11-20 2013-11-21
5.0
None Remote Low Not required None None Partial
The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors, related to an XML External Entity (XXE) issue.
49 CVE-2012-4341 119 DoS Exec Code Overflow 2012-08-15 2012-08-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value, (2) crafted string size field, or (3) long Parameter Name string in a package with opcode 0x43 and sub opcode 0x4 to TCP port 3900.
50 CVE-2012-2612 119 DoS Overflow 2012-05-15 2012-08-18
5.0
None Remote Low Not required None None Partial
The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
Total number of vulnerabilities : 69   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.