CVE-2018-17539: Undefined Security Weakness

The BGP daemon bgpd in all IP Infusion ZebOS versions to 7.10.6 and all OcNOS versions to 1.3.3.145 allow remote attackers to cause a denial of service attack via an autonomous system AS path containing 8 or more autonomous system number ASN elements...

CVE-2018-17244

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

CVE-2018-2494

Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform...

CVE-2018-2492

CVE-2018-2492 affects SAP NetWeaver AS Java where the SAML 2.0 functionality does not sufficiently validate XML documents from an untrusted source. The issue is resolved by updating to versions 7.2, 7.30, 7.31, 7.40 or 7.50. The description notes the vulnerability and its remediation, but the pro...

CVE-2018-2504

CVE-2018-2504 affects SAP NetWeaver AS Java Web Container. The issue arises because the HTTP Host header is not validated against a whitelist, enabling potential HTTP Host Header Manipulation and related XSS . Root cause: missing host header whitelisting in the web container. Impact is mitigated ...

CVE-2018-2494

The CVE-2018-2494 entry concerns privilege escalation due to insufficient authorization checks for an authenticated user in SAP NetWeaver SAP Basis AS ABAP. Connected sources confirm the affected software as SAP NetWeaver 700–750, with the fix delivered from version 750 onward as ABAP Platform. I...

CVE-2018-2504

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2503

The CVE-2018-2503 entry concerns SAP NetWeaver AS Java keystore service, where access to protected resources was not sufficiently restricted, enabling information disclosure. Public documents confirm this vulnerability exists in the SAP NetWeaver AS Java keystore service and that the issue has be...

CVE-2018-2497

The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE AS SELECT...

CVE-2018-2504: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in HTTP Host Header Manipulation or Cross-Site Scripting XSS vulnerability. This is fixed in versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

PT-2018-3415

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java versions prior to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description: The issue is related to insufficient access restrictions to protected resources in the SAP NetWeaver AS Java keystore service. This is due to authorizatio...

PT-2018-3536

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java versions prior to 7.2 SAP NetWeaver AS Java versions prior to 7.30 SAP NetWeaver AS Java versions prior to 7.31 SAP NetWeaver AS Java versions prior to 7.40 SAP NetWeaver AS Java versions prior to 7.50 Description: The...

PT-2018-3538

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java Web Container service versions prior to 7.10 SAP NetWeaver AS Java Web Container service versions prior to 7.11 SAP NetWeaver AS Java Web Container service versions prior to 7.20 SAP NetWeaver AS Java Web Container servi...

CVE-2018-2492: Improper Restriction of XML External Entity Reference

SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50...

CVE-2018-2503: Missing Authorization

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50...

CVE-2018-2494: Incorrect Authorization

Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP Basis AS ABAP of SAP NetWeaver 700 to 750, from 750 onwards delivered as ABAP Platform...

PT-2018-15601

Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 700 through 750 Description The issue concerns the lack of necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been fixed in SAP Basis AS ABAP of SAP NetWeaver...

CVE-2018-2497: Undefined Security Weakness

The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE AS SELECT...

Moderate: Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory

Updated packages that resolve various issues are now available for Red Hat OpenStack Platform 12.0 Pike for RHEL 7. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service IaaS cloud running on commonly available...

RHEL 7 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1064)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1064 advisory. OpenShift Enterprise by Red Hat is the company's cloud computing Platform- as-a-Service PaaS solution designed for on-premise or private clo...