3784 matches found
CVE-2015-4157
SAP Content Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2127995...
CVE-2015-2278
The LZH decompression implementation CsObjectInt::BuildHufTree function in vpa108csulzh.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers t...
Out-of-bounds
The LZH decompression implementation CsObjectInt::BuildHufTree function in vpa108csulzh.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers t...
Stack overflow
Stack-based buffer overflow in the LZC decompression implementation CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows...
Code injection
SAP Content Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2127995...
Information disclosure
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...
CVE-2015-2278
The LZH decompression implementation CsObjectInt::BuildHufTree function in vpa108csulzh.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers t...
CVE-2015-2282
Stack-based buffer overflow in the LZC decompression implementation CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows...
CVE-2015-4158
SAP ABAP & Java Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2121661...
CVE-2015-4161
SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...
CVE-2015-2278
CVE-2015-2278 and CVE-2015-2282 affect SAP products via the LZH/LZC decompression paths. The root causes are in the LZH BuildHufTree function (vpa108csulzh.cpp) and the LZC decompression logic (vpa106cslzc.cpp), where attacker-controlled indices can trigger out-of-bounds reads/writes. Affected so...
CVE-2015-4157
CVE-2015-4157 affects SAP Content Server. The available documents describe a remote denial-of-service risk (service termination) via unspecified vectors, as referenced by SAP Security Note 2127995. The primary sources do not specify the exact vulnerable component, affected versions, root cause, e...
CVE-2015-4161
SAP Afaria is affected by an information-disclosure vulnerability where access to unspecified functionality is not properly restricted (via the Services feature). A remote attacker could obtain sensitive information, and potentially gain privileges, with other unspecified impacts noted in SAP Sec...
CVE-2015-4158: Undefined Security Weakness
SAP ABAP & Java Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2121661...
CVE-2015-3995
SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565...
CVE-2015-3994
The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818...
Session fixation
The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818...
Code injection
SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565...
CVE-2015-3994
The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818...