CVSS: 6.6EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2451
https://notcve.org/view.php?id=CVE-2018-2451
14 Aug 2018 — XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolonged period of validity. Consequently, a platform user could access controller resources via active CLI session even after corresponding authorizations have been revoked meanwhile by an administrator user. Similarly, an attacker who managed to gain access to the platform user's session might misuse the session token even after the session has been clos... • http://www.securityfocus.com/bid/105091 • CWE-613: Insufficient Session Expiration •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2018-2424
https://notcve.org/view.php?id=CVE-2018-2424
12 Jun 2018 — SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 (Java) 7.30, 7.31, 7.40, 7,50; SAP UI 7.40, 7.50, 7.51, 7.52, and version 2.0 of SAP UI for SAP NetWeaver 7.00 SAP UI5 no validó las entradas de usuario antes de añadirlas a la estructura DOM. Esto podría conducir a que se añada al DOM ... • http://www.securityfocus.com/bid/104459 • CWE-20: Improper Input Validation •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2402
https://notcve.org/view.php?id=CVE-2018-2402
14 Mar 2018 — In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may be stored in clear text in the indexserver trace files of the control system. An attacker with the required authorizations on the control system may be able to access the user credentials and gain unauthorized access to data in the captured or target system. En sistemas que empleen la funcionalidad opcional de captura por reproducci... • http://www.securityfocus.com/bid/103369 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2378
https://notcve.org/view.php?id=CVE-2018-2378
14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption. En SAP HANA Extended Application Services 1.0, los usuarios no autorizados pueden leer datos estadísticos sobre las aplicaciones desplegadas, incluyendo el consumo de recursos. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2375
https://notcve.org/view.php?id=CVE-2018-2375
14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space. En SAP HANA Extended Application Services 1.0, un usuario controller que tenga la autorización SpaceAuditor en un espacio específico podría recuperar entornos de la aplicación en ese espacio. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2374
https://notcve.org/view.php?id=CVE-2018-2374
14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space. En SAP HANA Extended Application Services 1.0, un usuario controller que tenga la autorización SpaceAuditor en un espacio específico podría recuperar datos sensibles de la aplicación como los enlaces del servicio en ese espacio. • http://www.securityfocus.com/bid/103018 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-2369
https://notcve.org/view.php?id=CVE-2018-2369
14 Feb 2018 — Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can misuse the authentication function of the SAP HANA server on its SQL interface and disclose 8 bytes of the server process memory. The attacker cannot influence or predict the location of the leaked memory. Bajo ciertas condiciones, SAP HANA 1.00 y 2.00 permite que un atacante no autenticado acceda a información que, de otra forma, estaría restringida. U... • http://www.securityfocus.com/bid/102997 •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2376
https://notcve.org/view.php?id=CVE-2018-2376
14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space. En SAP HANA Extended Application Services 1.0, un usuario controller que tenga la autorización SpaceAuditor en un espacio específico podría recuperar entornos de la aplicación en ese espacio. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2372
https://notcve.org/view.php?id=CVE-2018-2372
14 Feb 2018 — A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communication. En la versión 1.0 de SAP HANA Extended Application Services, una contraseña keystore plana se escribe en un archivo de registro del sistema, lo que podría poner en peligro la confidencialidad de la comunicación SSL. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-2377
https://notcve.org/view.php?id=CVE-2018-2377
14 Feb 2018 — In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users. En SAP HANA Extended Application Services 1.0, algunos datos de estado y estadísticas generales del servidor podrían recuperarse por usuarios no autorizados. • https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 •