ZDI-10-032: SAP MaxDB Malformed Handshake Request Remote Code Execution Vulnerability

ZDI-10-032: SAP MaxDB Malformed Handshake Request Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-032 March 16, 2010 -- Affected Vendors: SAP -- Affected Products: SAP MaxDB -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have been...

SAP MaxDB code execution

Buffer overflow on TCP/7210 request parsing...

SAP MaxDB Detection

This host is running SAP MaxDB. MaxDB is an ANSI SQL-92 entry level compliant relational database management system RDBMS from SAP AG. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

SAP MaxDB 'serv.exe' Unspecified RCE Vulnerability (1409425)

SAP MaxDB is prone to an unspecified remote code execution RCE vulnerability because it fails to sufficiently validate user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

SAP MaxDB Malformed Handshake Request Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP MaxDB. Authentication is not required to exploit this vulnerability. The specific flaw exists within the serv.exe process which listens by default on TCP port 7210. The process trusts a value...

SAP MaxDB Remote Arbitrary Commands Execution (CVE-2008-0244)

SAP MaxDB is an open source relational database management system RDBMS developed and supported by SAP AG. MaxDB is targeted for large SAP environments such as mySAP Business Suite and other applications that require enterprise level database functionality. MaxDB is available for the most promine...

SAP MaxDB webdbm跨站脚本漏洞

BUGTRAQ ID: 34319 MaxDB是SAP应用中广泛使用的数据库管理系统。 MaxDB所使用的webdbm脚本没有正确地验证对Server、Database和User参数所传送的参数，远程攻击者可以通过执行参数执行跨站脚本攻击，导致窃取管理员cookie，或伪造登录页面，当用户试图登录的时候向攻击者发送口令。 SAP MaxDB 7.6.x SAP MaxDB 7.4.x SAP --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.sap.com/...

SAP MaxDB 7.47.6 - webdbm Multiple Cross-Site Scripting Vulnerabilities

SAP MaxDB 7.47.6 - webdbm Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/34319/info SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to...

SAP MaxDB 7.4/7.6 - 'webdbm' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/34319/info SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

Design/Logic Flaw

Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable...

CVE-2008-1810

Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable...

CVE-2008-1810

Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable...

SAP MaxDB privilege escalation

It's possible to obtain sdb:sdba privileges via dmbsrv process because of untrusted path usage...

SAP MaxDB Multiple Vulnerabilities

The remote host is running MaxDB, a database server from SAP. According to its version, the remote server is affected by a multiple flaws : - A vulnerability in 'vserver' process could allow an unauthenticated attacker to execute arbitrary code, subject to the privileges of the user under which t...

SAP MaxDB Multiple Vulnerabilities

Binary data 4494.prm...

CVE-2008-0307

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption...

Integer overflow

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption...

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...

Design/Logic Flaw

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...