3282 matches found
CVE-2016-3635
CVE-2016-3635 affects SAP NetWeaver 7.4. Remote authenticated users can bypass the Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by using a connection created from an earlier execution of an anonymous RFM included in a Communication Assembly (...
CVE-2016-4407
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008...
CVE-2016-7437
SAP NetWeaver 7.40 is affected by an issue where the SAP Security Audit Log misclassifies (1) DUI and (2) DUJ events as non-critical, potentially enabling local users to obscure rejected RFC function callback attempts by filtering non-critical events in audit reports. This is linked to SAP Securi...
CVE-2016-7437
SAP Netweaver 7.40 improperly logs 1 DUI and 2 DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC function callbacks by leveraging filtering of non-critical events in audit analysis reports, aka SAP Security Note 225231...
CVE-2016-3946
SAP Console (aka SAPConsole) 7.30 is affected by an information disclosure vulnerability where local users can read the Windows registry to obtain SAP Server login credentials. Root cause: insecure handling/storage of credentials in the Windows registry as described in SAP Security Note 2121461. ...
CVE-2016-7435
The 1 SCTCREFRESHEXPORTTABCOMP, 2 SCTCREFRESHCHECKENV, and 3 SCTCTMSMAINTAINALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security...
Code injection
The 1 SAPBASIS and 2 SAPABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621...
CVE-2016-7435
The 1 SCTCREFRESHEXPORTTABCOMP, 2 SCTCREFRESHCHECKENV, and 3 SCTCTMSMAINTAINALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security...
SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection Vulnerability
Exploit for windows platform in category remote exploits Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTCREFRESHEXPORTTABCOMP 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the...
SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection Vulnerability
Exploit for windows platform in category remote exploits Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTCREFRESHCHECKENV 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system...
SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection Vulnerability
Exploit for windows platform in category remote exploits Onapsis Security Advisory ONAPSIS-2016-043: SAP OS Command Injection in SCTCTMSMAINTAINALOG 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system...
SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection
Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTCREFRESHEXPORTTABCOMP 1. Impact on Business ===================== By exploiting this vulnerability an authenticated user will be able to take full control of the system. Risk Level: Critical 2. Advisory Information...
CVE-2016-6146
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6146
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6137
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
Design/Logic Flaw
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
Information disclosure
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6137
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
CVE-2016-6137
SAP TREX 7.10 Revision 63 is affected by CVE-2016-6137, a remote command execution vulnerability stemming from an unspecified function that enables arbitrary OS command execution via unknown vectors (aka SAP Security Note 2203591). The public documents do not reveal the exact vulnerable component...