SAP MaxDB 7.47.6 - webdbm Multiple Cross-Site Scripting Vulnerabilities

SAP MaxDB 7.47.6 - webdbm Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/34319/info SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to...

SAP SAPDB (WEB DBM) XSS Vulnerability

Application: SAPDB Versions Affected: Last Vendor URL: Bugs: XSS Exploits: YES Reported: 20.11.2008 Vendor response: 20.11.2008 Date of Public Advisory: 31.03.2009 Description SAP MaxDB Web Database engine which listens port 9999 has a Linked XSS security vulnerability. Business Risk An attacker...

SAP MaxDB dbmsrv 进程PATH环境变量本地权限提升漏洞

BUGTRAQ ID: 30474 CVECAN ID: CVE-2008-1810 MaxDB是SAP应用中广泛使用的数据库管理系统。 当本地用户运行dbmcli程序时，MaxDB会代表用户执行dbmsrv进程。该进程负责执行用户命令，以sdba组的sdb用户权限运行。由于没有正确地过滤PATH环境变量，如果在变量前添加了攻击者所控制的路径的话，就可能导致以sdb:sdba权限执行任意指令。 SAP MaxDB 7.6.03.15 SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sap.com/...

CVE-2008-1810

Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable...

Design/Logic Flaw

Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable...

CVE-2008-1810

The CVE-2008-1810 issue affects SAP MaxDB 7.6.03.15 on Linux, where the dbmsrv process runs with sdb:sdba privileges and is vulnerable to privilege escalation via a manipulated PATH variable. Local users can exploit an untrusted search path by prefixing PATH with attacker-controlled directories w...

CVE-2008-1810

Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable...

SAP MaxDB privilege escalation

It's possible to obtain sdb:sdba privileges via dmbsrv process because of untrusted path usage...

iDefense Security Advisory 07.30.08: SAP MaxDB dbmsrv Untrusted Execution Path Vulnerability

iDefense Security Advisory 07.30.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 30, 2008 I. BACKGROUND SAP's MaxDB is a database software product. MaxDB was released as open source from version 7.5 up to version 7.6.00. Later versions are no longer open source but are available for...

MySQL MaxDB Webtool <= 7.5.00.23 Remote Stack Overflow Exploit

No description provided by source. / MySQL MaxDB Webtool Remote Stack Overflow Exploit cybertronicatgmxdotnet 04/27/2005 / / / / / / / / / / / / / / / / / / / // // / // / / / / // / / // / / / / / / /, /./// // // //// // -- exploit by : cybertronic - cybertronicatgmxdotnet -- select...

SAP MaxDB Multiple Vulnerabilities

The remote host is running MaxDB, a database server from SAP. According to its version, the remote server is affected by a multiple flaws : - A vulnerability in 'vserver' process could allow an unauthenticated attacker to execute arbitrary code, subject to the privileges of the user under which t...

SAP MaxDB Multiple Vulnerabilities

Binary data 4494.prm...

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...

Integer overflow

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption...

Design/Logic Flaw

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...

CVE-2008-0307

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption...

CVE-2008-0307

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption...

CVE-2008-0307

Integer signedness error in vserver in SAP MaxDB 7.6.0.37, and possibly other versions, allows remote attackers to execute arbitrary code via unknown vectors that trigger heap corruption...

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...