Information disclosure

SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...

Code injection

SAP ABAP & Java Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2121661...

CVE-2015-4161

SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690...

CVE-2015-4158

SAP ABAP & Java Server allows remote attackers to cause a denial of service service termination via unspecified vectors, aka SAP Security Note 2121661...

CVE-2015-2278

CVE-2015-2278 and CVE-2015-2282 affect SAP products via the LZH/LZC decompression paths. The root causes are in the LZH BuildHufTree function (vpa108csulzh.cpp) and the LZC decompression logic (vpa106cslzc.cpp), where attacker-controlled indices can trigger out-of-bounds reads/writes. Affected so...

CVE-2015-4160

SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278...

CVE-2015-4159

The CVE-2015-4159 entry concerns SAP HANA Web-based Development Workbench with an SQL injection vulnerability. The affected component is the Web-based Development Workbench in SAP HANA, where remote attackers can submit specially crafted SQL commands to manipulate or obtain data. The root cause i...

CVE-2015-4161

SAP Afaria is affected by an information-disclosure vulnerability where access to unspecified functionality is not properly restricted (via the Services feature). A remote attacker could obtain sensitive information, and potentially gain privileges, with other unspecified impacts noted in SAP Sec...

CVE-2015-4157

CVE-2015-4157 affects SAP Content Server. The available documents describe a remote denial-of-service risk (service termination) via unspecified vectors, as referenced by SAP Security Note 2127995. The primary sources do not specify the exact vulnerable component, affected versions, root cause, e...

CVE-2015-3994

The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818...

Xxe

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

Buffer overflow

Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690...

CVE-2015-4091

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2015-3980

SQL injection vulnerability in the Business Rules Framework CRM-BF-BRF in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534...

Information disclosure

SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037...

Default credentials

SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830...

CVE-2015-3981

SAP NetWeaver RFC SDK is affected by an information-disclosure vulnerability (CVE-2015-3981). Connected sources indicate that remote attackers may obtain sensitive information via unspecified vectors, referencing SAP Security Note 2084037. The exact vulnerable component is the RFC SDK within SAP ...

CVE-2015-3980

The SAP CRM vulnerability CVE-2015-3980 affects the Business Rules Framework (CRM-BF-BRF) in SAP CRM. It is a SQL injection flaw that lets attackers remotely submit specially crafted SQL queries to the backend, enabling data manipulation or disclosure. Root cause appears to be unsafe SQL handling...

CVE-2015-3981

SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037...

CVE-2015-3978

CVE-2015-3978 affects the SAP Sybase Unwired Platform Online Data Proxy. A vulnerability in the DataVault library could allow a local attacker to obtain usernames and passwords, as noted in SAP Security Note 2094830. The CVSS-derived data indicates a local attack with low base severity and partia...