Cross site scripting

Cross-site scripting XSS vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669...

CVE-2015-6663

Cross-site scripting XSS vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669...

CVE-2015-6663

CVE-2015-6663 is a stored XSS vulnerability in SAP Afaria 7 affecting the Device Inspector page, specifically the Client form. The issue arises because the Client name field data is inserted into the page without proper escaping, enabling an attacker to inject arbitrary script via crafted data. T...

SAP Afaria 7 multiple security vulnerabilities

Buffer overflow, information leakage, DoS...

[ERPSCAN-15-012] SAP Afaria 7 XComms – Buffer Overflow

ERPSCAN Research Advisory ERPSCAN-15-012 SAP Afaria 7 XComms – Buffer Overflow Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Buffer Overflow Sent: 13.03.2015 Reported: 14.03.2015 Vendor response: 14.03.2015 Date of Public Advisory:...

SAP Afaria 'XeService.exe' Insecure File Permissions Vulnerability

SAP Afaria is a mobile device management and security solution. A security vulnerability exists in the Windows client of SAP Afaria version 7.0.6398.0, which can be exploited by a local attacker to gain privileges with the help of the Trojan horse XeService.exe file...

CVE-2015-3449

The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions Everyone: read and Everyone: write for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file...

Code injection

The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions Everyone: read and Everyone: write for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file...

CVE-2015-3449

The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions Everyone: read and Everyone: write for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file...

CVE-2015-3449

The CVE-2015-3449 entry concerns the Windows client of SAP Afaria 7.0.6398.0. A root cause is insecure/permissive file permissions on the install folder (Everyone: read and Everyone: write), which enables a local attacker to gain privileges via a Trojan horse XeService.exe file. This describes a ...

The vulnerability of the SAP Afaria mobile device management program allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the SAP Afaria mobile device management program arises due to an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code using a specially crafted request...

The vulnerability of the SAP Afaria mobile device management program allows a hacker to gain access to protected information or enhance their privileges.

The vulnerability of the SAP Afaria mobile device management program is related to deficiencies in access control for files. Exploiting this vulnerability can allow a malicious actor to gain access to protected information or enhance their privileges...

The vulnerability of the SAP Afaria mobile device management program, which allows a hacker to trigger service failures

The vulnerability of the XcListener component in the SAP Afaria mobile device management software allows a malicious actor to trigger service failures through a specially crafted request...

SAP Afaria security vulnerabilities

DoS, authentication bypass...

[ERPSCAN-15-009] SAP Afaria 7 XcListener - Missing authorization check

ERPSCAN Research Advisory ERPSCAN-15-009 SAP Afaria 7 XcListener - Missing authorization check Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Missing authorization check Sent: 09.12.2014 Reported: 09.12.2014 Vendor response: 10.12.2014...

SAP Afaria Information Disclosure Vulnerability

SAP Afaria is a mobile device management solution from SAP. The solution supports the effective management of mobile devices, applications, and data lifecycles and ensures their security during transmission and storage. A security vulnerability existed in SAP Afaria. Due to the program failing to...

CVE-2015-4161

SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...

Information disclosure

SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...

CVE-2015-4161

SAP Afaria is affected by an information-disclosure vulnerability where access to unspecified functionality is not properly restricted (via the Services feature). A remote attacker could obtain sensitive information, and potentially gain privileges, with other unspecified impacts noted in SAP Sec...

CVE-2015-4161

SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...