Page 4 of 86 results (0.001 seconds)

CVSS: 6.6EPSS: 0%CPEs: 1EXPL: 0

14 Aug 2018 — XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolonged period of validity. Consequently, a platform user could access controller resources via active CLI session even after corresponding authorizations have been revoked meanwhile by an administrator user. Similarly, an attacker who managed to gain access to the platform user's session might misuse the session token even after the session has been clos... • http://www.securityfocus.com/bid/105091 • CWE-613: Insufficient Session Expiration •

CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0

12 Jun 2018 — SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00 SAP UI5 no validó las entradas de usuario antes de añadirlas a la estructura DOM. Esto podría conducir a que se añada al DOM ... • http://www.securityfocus.com/bid/104459 • CWE-20: Improper Input Validation •

CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0

14 Mar 2018 — In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system. En sistemas que empleen la funcionalidad opcional de captura por reproducci... • http://www.securityfocus.com/bid/103369 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption. En SAP HANA Extended Application Services 1.0, los usuarios no autorizados pueden leer datos estadísticos sobre las aplicaciones desplegadas, incluyendo el consumo de recursos. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •

CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0

14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space. En SAP HANA Extended Application Services 1.0, un usuario controller que tenga la autorización SpaceAuditor en un espacio específico podría recuperar entornos de la aplicación en ese espacio. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space. En SAP HANA Extended Application Services 1.0, un usuario controller que tenga la autorización SpaceAuditor en un espacio específico podría recuperar datos sensibles de la aplicación como los enlaces del servicio en ese espacio. • http://www.securityfocus.com/bid/103018 •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

14 Feb 2018 — Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the SAP HANA server on its SQL interface and disclose 8 bytes of the server process memory. The attacker cannot influence or predict the location of the leaked memory. Bajo ciertas condiciones, SAP HANA 1.00 y 2.00 permite que un atacante no autenticado acceda a información que, de otra forma, estaría restringida. U... • http://www.securityfocus.com/bid/102997 •

CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0

14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space. En SAP HANA Extended Application Services 1.0, un usuario controller que tenga la autorización SpaceAuditor en un espacio específico podría recuperar entornos de la aplicación en ese espacio. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

14 Feb 2018 — A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communication. En la versión 1.0 de SAP HANA Extended Application Services, una contraseña keystore plana se escribe en un archivo de registro del sistema, lo que podría poner en peligro la confidencialidad de la comunicación SSL. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users. En SAP HANA Extended Application Services 1.0, algunos datos de estado y estadísticas generales del servidor podrían recuperarse por usuarios no autorizados. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •