62 matches found
CVE-2018-2451
XS Command-Line Interface CLI user sessions with the SAP HANA Extended Application Services XS, version 1, advanced server may have an unintentional prolonged period of validity. Consequently, a platform user could access controller resources via active CLI session even after corresponding...
CVE-2018-2451
The CVE-2018-2451 issue concerns SAP HANA XS v1 (Extended Application Services) where a user’s CLI session may remain valid beyond revoked authorizations, allowing a platform user to access controller resources via an active session and an attacker with a session to misuse the token after closure...
CVE-2018-2377
In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users...
CVE-2018-2378
In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption...
CVE-2018-2374
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space...
CVE-2018-2377
In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users...
Authorization
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...
CVE-2018-2375
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...
CVE-2018-2372
A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communication...
CVE-2018-2378
In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption...
CVE-2018-2373
Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP HANA Extended Application Services, 1.0...
CVE-2018-2379
In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint...
Authorization
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...
Authorization
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space...
CVE-2018-2378
SAP HANA Extended Application Services (EAS) 1.0 is affected by CVE-2018-2378, where unauthorized users can read statistical data about deployed applications, including resource consumption (information disclosure). The exact root cause, exploitable vectors, and fixes are not detailed in the prov...
CVE-2018-2374
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space...
CVE-2018-2377
The CVE-2018-2377 issue affects SAP HANA Extended Application Services 1.0. It allows unauthorized users to retrieve some general server statistics and status information, indicating a partial confidentiality impact. Root cause details are not explicitly provided beyond exposure of server metadat...
CVE-2018-2376
CVE-2018-2376 affects SAP HANA Extended Application Services 1.0. a controller user with SpaceAuditor authorization in a specific space could retrieve application environments within that space. No exploitation details are provided in the documents; remediation guidance (from PT-2018-15509) sugge...
CVE-2018-2372
This CVE concerns SAP HANA Extended Application Services (SAP HANA XAS) 1.0, where a plaintext keystore password is written to a system log file. The underlying issue is exposure of sensitive credentials via logs, potentially compromising SSL confidentiality. Affected component/file: keystore/pas...