CVE-2015-2820

SAP Afaria’s XcListener is affected by a buffer overflow that can be triggered by a crafted request, causing remote denial of service (process termination). This is tied to CVE-2015-2820 and SAP Security Note 2132584. ERPScan’s advisory confirms the affected component and provides PoC details sho...

CVE-2015-6663

CVE-2015-6663 is a stored XSS vulnerability in SAP Afaria 7 affecting the Device Inspector page, specifically the Client form. The issue arises because the Client name field data is inserted into the page without proper escaping, enabling an attacker to inject arbitrary script via crafted data. T...

CVE-2015-4092

SAP Afaria 7.00.6620.2 SP5 contains a Buffer Overflow in the XComms process (CVE-2015-4092). ERPScan/SAP advisories describe that an anonymous attacker can remotely exploit a crafted request to crash the server’s XComms component and potentially execute code. Impact includes DoS and, in some disc...

CVE-2015-2816

The CVE-2015-2816 issue affects SAP Afaria 7.0.6001.5 via the XcListener, which has a missing authorization check that can be exploited remotely (via crafted requests) to misuse service functionality and potentially cause DoS or information exposure. Technical details from ERPScan advisory show t...

CVE-2015-4161

SAP Afaria is affected by an information-disclosure vulnerability where access to unspecified functionality is not properly restricted (via the Services feature). A remote attacker could obtain sensitive information, and potentially gain privileges, with other unspecified impacts noted in SAP Sec...

CVE-2015-8753

The CVE concerns SAP Afaria 7.0.6001.5, where a crafted request allows remote attackers to bypass authorization and wipe or lock mobile devices. The issue is described as related to an

CVE-2015-3449

The CVE-2015-3449 entry concerns the Windows client of SAP Afaria 7.0.6398.0. A root cause is insecure/permissive file permissions on the install folder (Everyone: read and Everyone: write), which enables a local attacker to gain privileges via a Trojan horse XeService.exe file. This describes a ...