CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-4407
https://notcve.org/view.php?id=CVE-2016-4407
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008. El algoritmo de implementación DSA en SAP SAPCRYPTOLIB 5.555.38 no comprueba adecuadamente las firmas, lo que permite a usuarios remotos autenticados imitar usuarios arbitrarios a través de vectores no especificados, vulnerabilidad también conocida como SAP Security Note 2223008. • http://seclists.org/fulldisclosure/2016/Oct/32 http://www.securityfocus.com/bid/93502 https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-8587
https://notcve.org/view.php?id=CVE-2014-8587
SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA) signatures via unspecified vectors. SAPCRYPTOLIB anterior a 5.555.38, SAPSECULIB, y CommonCryptoLib anterior a 8.4.30, utilizados en SAP NetWeaver AS para ABAP y SAP HANA, permiten a atacantes remotos falsificar firmas Digital Signature Algorithm (DSA) a través de vectores no especificados. • http://blog.onapsis.com/sap-security-note-2067859-potential-exposure-to-digital-signature-spoofing http://secunia.com/advisories/57606 http://service.sap.com/sap/support/notes/2067859 https://twitter.com/SAP_Gsupport/status/522401681997570048 • CWE-310: Cryptographic Issues •