CVE-2015-7991

The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854...

CVE-2015-7828

SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the 1 fcopydir, 2 fmkdir, 3 frmdir, 4 getenv, 5 dumpenv, 6 fcopy, 7 fput, 8 fdel, 9 fmove, 10 fget, 11 fappend, ...

CVE-2015-7994

The SQL interface in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428...

Authentication flaw

SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the 1 fcopydir, 2 fmkdir, 3 frmdir, 4 getenv, 5 dumpenv, 6 fcopy, 7 fput, 8 fdel, 9 fmove, 10 fget, 11 fappend, ...

Design/Logic Flaw

The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords via unspecified vectors, aka SAP Security Note 2148854...

Design/Logic Flaw

The Extended Application Services aka XS or XS Engine in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote attackers to execute arbitrary code via unspecified vectors related to "HTTP Login," aka SAP Security Note 2197397...

CVE-2015-7992

SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) is affected by CVE-2015-7992. Remote authenticated users can trigger a denial of service (memory corruption and indexserver crash) by calling the EXECUTE_SEARCH_RULE_SET stored procedure, per SAP Security Note 2175928. Exploitation details and exact ve...

CVE-2015-7994

The SQL interface in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428...

CVE-2015-7992

SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to cause a denial of service memory corruption and indexserver crash via unspecified vectors to the EXECUTESEARCHRULESET stored procedure, aka SAP Security Note 2175928...

Cross site scripting

Cross-site scripting XSS vulnerability in Apache Ambari before 2.1.0 allows remote authenticated cluster operator users to inject arbitrary web script or HTML via the note field in a configuration change...

cli

Getting started with the Snyk CLI Introduction to Snyk and...

CVE-2015-7986

The index server hdbindexserver in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via an HTTP request, aka SAP Security Note 2197428...

Memory corruption

The index server hdbindexserver in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via an HTTP request, aka SAP Security Note 2197428...

CVE-2015-7986

The index server hdbindexserver in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via an HTTP request, aka SAP Security Note 2197428...

CVE-2015-7986

The CVE-2015-7986 issue affects SAP HANA 1.00.095, where the index server (hdbindexserver) memory can be corrupted via a remote HTTP request, enabling potentially remote code execution. Public advisories (ERPScan ERPSCAN-15-024) describe memory corruption and RCE with full-system impact; vendor S...

ERPSCAN Research Advisory [ERPSCAN-15-017] SAP NetWeaver J2EE DAS service - Unauthorized Access

ERPSCAN Research Advisory ERPSCAN-15-017 SAP NetWeaver J2EE DAS service - Unauthorized Access Application: SAP NetWeaver Versions Affected: SAP NetWeaver AS JAVA, probably others Vendor URL: http://SAP.com Bugs: Unauthorized access Sent: 20.04.2013 Reported: 21.04.2013 Vendor response: 21.04.2013...

SAP NetWeaver JAVA AS UDDI component - XXE vulnerability

Application: SAP AS JAVA Versions Affected: SAP AS JAVA 7.4 Vendor URL: SAP Bugs: XXE Reported: 20.10.2015 Vendor response: 21.10.2015 Date of Public Advisory: 14.04.2016 Reference: SAP Security Note 2254389 Author: Vahagn Vardanyan ERPScan Vulnerability Information Class: denial of service Impac...

SAP NetWeaver Java AS ctcprotocol servlet - XXE vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.1 – 7.5 Vendor URL: SAP Bug: XXE Reported: 20.10.2015 Vendor response: 21.10.2015 Date of Public Advisory: 08.03.2016 Reference: SAP Security Note 2235994 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XXE Impact:...

SAP NetWeaver AS Java NavigationURLTester - XSS vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4 Vendor URL: SAP Bugs: XSS vulnerability Reported: 20.10.2015 Vendor response: 21.10.2015 Date of Public Advisory: 08.03.2016 Reference: SAP Security Note 2238375 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XSS...

flash-plugin: multiple code execution issue fixed in APSB15-27

Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7648...