260 matches found
SAP Updates Two-Year-Old Patch for TREX Vulnerability
SAP has issued an updated patch for a code-injection vulnerability affecting the TREX search engine integrated into more than a dozen SAP products, including the old NetWeaver application integration platform and the SAP HANA database. The flaw was originally found in 2015 and patched in SAP HANA...
CVE-2017-7691
A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator BWA. The vendor response is SAP Security Note 2419592...
Code injection
A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator BWA. The vendor response is SAP Security Note 2419592...
CVE-2017-7691
A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator BWA. The vendor response is SAP Security Note 2419592...
CVE-2017-7691
The CVE-2017-7691 entry concerns a code-injection/remote code execution vulnerability in SAP TREX and the Business Warehouse Accelerator (BWA). The root cause described across sources is an insecure protocol/engine interaction within TREX that could be exploited to inject and execute code on the ...
SAP TREX RCE
Application: SAP TREX Versions Affected: SAP TREX 7.10 Vendor URL: SAP Bugs: RCE Reported: 23.01.2017 Vendor response: 24.01.2017 Date of Public Advisory: 11.04.2017 Reference: SAP Security Note 2419592 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: Missing Authentication for...
CVE-2016-6146
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6146
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6137
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
CVE-2016-6137
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
Design/Logic Flaw
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
Information disclosure
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6137
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591...
CVE-2016-6137
SAP TREX 7.10 Revision 63 is affected by CVE-2016-6137, a remote command execution vulnerability stemming from an unspecified function that enables arbitrary OS command execution via unknown vectors (aka SAP Security Note 2203591). The public documents do not reveal the exact vulnerable component...
CVE-2016-6146
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226...
CVE-2016-6146
CVE-2016-6146 affects SAP TREX 7.10 Revision 63 NameServer. It enables remote attackers to disclose sensitive TNS information via an unspecified query (information disclosure). Exploitation details (vector, conditions, exploit code) are not provided in the documents; CVSS suggests network access ...
SAP TREX Information Disclosure Vulnerability (CNVD-2016-07355)
SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. An information disclosure vulnerability exists in SAP TREX version 7.10 Revision 63, which can be exploited by a remote attacker to disclose technical information about the TREX system and perform queries o...
SAP TREX Remote Command Execution Vulnerability
SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. A remote command execution vulnerability exists in version 7.10 of SAP TREX that could be exploited by an attacker to execute arbitrary code in the context of an affected application...