[Onapsis Security Advisory 2014-022] SAP HANA IU5 SDK Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory2014-022: SAP HANA IU5 SDK Authentication Bypass This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand...

Design/Logic Flaw

SAP HANA Extend Application Services XS allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public...

PT-2014-6312 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extend Application Services XS affected versions not specified Description: The issue allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public. There is no information...

PT-2014-6310 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extend Application Services XS affected versions not specified Description: The issue concerns the lack of encryption for transmissions in applications that use form-based authentication with SSL, allowing remote attackers to interce...

CVE-2014-5171: Undefined Security Weakness

SAP HANA Extend Application Services XS does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network...

CVE-2014-5173: Undefined Security Weakness

SAP HANA Extend Application Services XS allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public...

CVE-2014-3285: Improper Input Validation

Cisco Wide Area Application Services WAAS 5.3.5a and earlier, when SharePoint acceleration is enabled, does not properly parse SharePoint responses, which allows remote attackers to cause a denial of service application-optimization handler reload via a crafted SharePoint application, aka Bug ID...

PT-2014-5181

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services WAAS versions 5.3.5a and earlier Description The issue is related to the improper parsing of SharePoint responses when SharePoint acceleration is enabled. This allows remote attackers to cause a denial of...

CVE-2014-2196: Improper Control of Generation of Code

Cisco Wide Area Application Services WAAS 5.1.1 before 5.1.1e, when SharePoint prefetch optimization is enabled, allows remote SharePoint servers to execute arbitrary code via a malformed response, aka Bug ID CSCue18479...

PT-2014-4550

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services WAAS versions 5.1.1 through 5.1.1e Description The issue allows remote SharePoint servers to execute arbitrary code via a malformed response when SharePoint prefetch optimization is enabled. Recommendations...

Cisco Wide Area Application Services Remote Code Execution Vulnerability

A vulnerability in Cisco Wide Area Application Services WAAS software versions 5.1.1 through 5.1.1d, when configured with the SharePoint acceleration feature, could allow an unauthenticated, remote attacker to exploit a buffer overflow and cause arbitrary code execution. The vulnerability is due ...

CVE-2013-5554: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web-management interface in the server in Cisco Wide Area Application Services WAAS Mobile before 3.5.5 allows remote attackers to upload and execute arbitrary files via a crafted POST request, aka Bug ID CSCuh69773...

PT-2013-5635

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services WAAS Mobile versions prior to 3.5.5 Description The issue is related to a directory traversal vulnerability in the web-management interface of the server. This allows remote attackers to upload and execute...

Cisco Wide Area Application Services, CDS, VDS, CDM code execution

Code execution via HTTP POST request, privilege escalation...

CVE-2012-1348: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Wide Area Application Services WAAS appliances with software 4.4, 5.0, and 5.1 include a one-way hash of a password within output text, which might allow remote attackers to obtain sensitive information via a brute-force attack on the hash string, aka Bug ID CSCty17279...

PT-2012-3201

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services WAAS appliances version 4.4 Cisco Wide Area Application Services WAAS appliances version 5.0 Cisco Wide Area Application Services WAAS appliances version 5.1 Description The issue allows remote attackers to...

CVE-2007-3923

The Common Internet File System CIFS optimization in Cisco Wide Area Application Services WAAS 4.0.7 and 4.0.9, as used by Cisco WAE appliance and the NM-WAE-502 network module, when Edge Services are configured, allows remote attackers to cause a denial of service loss of service via a flood of...

CVE-2007-3923: Undefined Security Weakness

The Common Internet File System CIFS optimization in Cisco Wide Area Application Services WAAS 4.0.7 and 4.0.9, as used by Cisco WAE appliance and the NM-WAE-502 network module, when Edge Services are configured, allows remote attackers to cause a denial of service loss of service via a flood of...

Denial of Service Vulnerability in Cisco Wide Area Application Services (WAAS) Software

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...