CVE-2016-6145

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...

CVE-2016-6144

The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the passwordlockforsystemuser is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP...

Code injection

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...

CVE-2016-6145

The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailederroronconnect option is not supported or is configured as "False," which allows remote attackers to enumerat...

CVE-2016-6144

The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the passwordlockforsystemuser is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP...

CVE-2016-6145

SAP HANA DB 1.00.091.00.1418659308 is affected by a user-enumeration vulnerability where the SQL interface leaks different error messages for failed logins depending on whether a username exists/ is locked due to the detailed_error_on_connect setting. Remote attackers could exploit a series of lo...

CVE-2016-6144

SAP HANA SQL interface vulnerability CVE-2016-6144 affects SAP HANA versions prior to Revision 102, where login attempts for SYSTEM are not rate-limited when password_lock_for_system_user is unsupported or false, enabling brute-force authentication bypass. Impact: remote attacker could bypass aut...