CVE-2016-9966

The CVE concerns Samsung Note devices running Android L/M/N where the Telecom application receivers lack proper exception handling. This defect can cause system crashes leading to a possible DoS, and may allow privilege escalation. Details across sources (CVE-2016-9966, CNVD-2016-13010, NVD) conf...

CVE-2016-9967

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L5.0/5.1, M6.0, and N7.0 software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7121...

CVE-2016-9967

CVE-2016-9967 affects the Telecom application receiver component on Samsung Note smartphones running Android L (5.0/5.1), M (6.0), and N (7.0). The issue is a lack of proper exception handling in those receivers, which can crash the system and potentially allow privilege escalation. The Samsung i...

CVE-2016-9965

CVE-2016-9965 concerns a denial-of-service/privilege-escalation risk in Samsung Note devices. The connected CNVD-2016-13011 and related entries describe a vulnerability in the Telecom application’s receiver on Note devices running Android L/5.x, M/6.x, and N/7.0, arising from improper exception h...

CVE-2016-9966

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L5.0/5.1, M6.0, and N7.0 software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120...

CVE-2016-9965

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L5.0/5.1, M6.0, and N7.0 software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7119...

Moodle 3.1.x < 3.1.3 Multiple Vulnerabilities

Binary data 9838.prm...

SAP GUI for Windows - Remote Code Execution + bypass security policy

Application: SAP GUI Versions Affected: SAP GUI 7.2-7.5 Vendor URL: SAP Bugs: Remote Code Execution Reported: 15.12.2016 Vendor response: 16.12.2016 Date of Public Advisory: 14.03.2017 Reference: SAP Security Note 2407616 Authors: Dmitry Yudin ERPScan aka @ret5et, Vahagn Vardanyan ERPScan, Dmitry...

SAP NetWeaver AS ABAP disp+work crash

Application: SAP NetWeaver ABAP Versions Affected: SAP KERNEL 7.40 64BIT, disp+work.exe 7400.12.21.30308 Vendor URL: SAP Bugs: DoS Reported: 15.12.2016 Vendor response: 16.12.2016 Date of Public Advisory: 14.03.2017 Reference: SAP Security Note 2406841 Author: Vahagn Vardanyan ERPScan VULNERABILI...

SAP GUI for Java - insecure default settings

Application: SAP GUI for Java Versions Affected: SAP GUI for Java 7.40 Vendor URL: SAP Bug: Insecure default settings Reported: 15.12.2016 Vendor response: 16.12.2016 Date of Public Advisory: 09.05.2017 Reference: SAP Security Note 2448972 Authors: Dmitry Yudin ERPScan, Vahagn Vardanyan ERPScan,...

Hardcoded credentials

SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of a hardcoded key in the program code and a computer BIOS serial...

CVE-2016-3684

SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338...

CVE-2016-3685

Affected software: SAP Download Manager up to version 2.1.142. Root cause: encryption of sensitive values stored in a configuration file uses a fixed static key; on Windows and macOS the key is the BIOS serial number concatenated with a hard-coded key, enabling attackers with local access to reco...

CVE-2016-3684

SAP Download Manager (versions up to 2.1.142) stores sensitive values in a configuration file encrypted with a hard-coded key. On Windows/Mac, the key combines the BIOS serial with a fixed key; on Linux/other platforms, the key is a fixed hard-coded value. This enables context-dependent attackers...

SAP NetWeaver AS JAVA 7.3 AS JAVA XSS in ctcprotocol/Protocol servlet

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.3 Vendor URL: SAP Bugs: XXS Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 11.04.2017 Reference: SAP Security Note 2406783 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS...

SAP NetWeaver AS Java XSS in GenericSemanticTest component

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.4 Vendor URL: SAP Bugs: XSS Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 14.03.2017 Reference: SAP Security Note 2408100 Author: Boris Sanin ERPScan VULNERABILITY INFORMATION Class: XSS...

SAP HANA Sinopia - default user creation policy insecure

Application: SAP HANA Versions Affected: SAP HANA SPS12 Vendor URL: SAP Bug: Insecure default configuration Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 14.02.2017 Reference: SAP Security Note 2407694 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class:...

SAP NetWeaver 7.3 AS Java XSS in CAFAdapterTest servlet

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.3 Vendor URL: SAP Bug: XSS Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 13.06.2017 Reference: SAP Security Note 2405943 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

SAP HANA XS Sinopia - DoS vulnerability

Application: SAP HANA Versions Affected: SAP HANA 1 and SAP HANA 2 Vendor URL: SAP Bug: DoS Reported: 13.12.2016 Vendor response: 14.12.2016 Date of Public Advisory: 14.02.2017 Reference: SAP Security Note 2407694 Authors: Mikhail Medvedev ERPScan, Mathieu Geli ERPScan VULNERABILITY INFORMATION...

SAP Solman - user accounts disclosure CVE-2016-10005

Application: SAP Solman Versions Affected: SAP Solman 7.1-7.31 Vendor URL: SAP Bugs: Information Disclosure Reported: 12.07.2016 Vendor response: 13.07.2016 Date of Public Advisory: 13.09.2016 Reference: SAP Security Note 2344524 Author: Roman Bezhan ERPScan VULNERABILITY INFORMATION CVE-2016-100...