CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 4CVE-2015-2282
https://notcve.org/view.php?id=CVE-2015-2282
Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. Desbordamiento de buffer basado en pila en la implementación LZC decompression (la función CsObjectInt::CsDecomprLZC en vpa106cslzc.cpp) en SAP MaxDB 7.5 y 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, la herramienta de archivos SAPCAR, y otros productos permite a atacantes dependientes de contexto causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de vectores no especificados, también conocido como las notas de seguridad de 2124806, 2121661, 2127995, y 2125316. • http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html http://seclists.org/fulldisclosure/2015/May/50 http://seclists.org/fulldisclosure/2015/May/96 http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities http://www.securityfocus.com/archive/1/535535/100/0/threaded http://www.securityfocus.com/bid/74643 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 4CVE-2015-2278
https://notcve.org/view.php?id=CVE-2015-2278
The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. La implementación LZH decompression (la función CsObjectInt::BuildHufTree en vpa108csulzh.cpp) en SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, la herramienta de archivos SAPCAR, y otros productos permite a atacantes dependientes de contexto causar una denegación de servicio (lectura fuera de rango) a través de vectores no especificados, relacionado con búsquedas de códigos no simples, también conocido como las notas de seguridad de SAP 2124806, 2121661, 2127995, y 2125316. • http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html http://seclists.org/fulldisclosure/2015/May/50 http://seclists.org/fulldisclosure/2015/May/96 http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities http://www.securityfocus.com/archive/1/535535/100/0/threaded http://www.securityfocus.com/bid/74643 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2007-1914
https://notcve.org/view.php?id=CVE-2007-1914
The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. La función RFC_START_PROGRAM en SAP RFC Library 6.40 y 7.00 anerior a 20061211 permite a atacantes remotos obtener información sensible (configuración del servidor de datos RFC externo) a través de vectores no especificados, una vulnerabilidad diferente que CVE-2006-6010. NOTA: Esta información se basa sobre un acceso inicial vago. • http://secunia.com/advisories/24722 http://securityreason.com/securityalert/2538 http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_PROGRAM_RFC_Function_Multiple_Vulnerabilities.pdf http://www.securityfocus.com/archive/1/464678/100/0/threaded http://www.securityfocus.com/bid/23313 http://www.vupen.com/english/advisories/2007/1270 https://exchange.xforce.ibmcloud.com/vulnerabilities/33422 •
CVSS: 5.0EPSS: 4%CPEs: 12EXPL: 0CVE-2007-1918
https://notcve.org/view.php?id=CVE-2007-1918
The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server, which allows remote attackers to cause a denial of service (client lockout) via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. La función RFC_SET_REG_SERVER_PROPERTY en la libreria SAP RFC Library 6.40 y 7.00 anterior a 20070109 implementa una opción para acceso exclusivo a un servidor RFC, lo cual permite a atacantes remotos provocar denegación de servico (cierre del cliente) a través de vectores no especificados. NOTA: Esta información se basa en una vaga descripción inicial. • http://secunia.com/advisories/24722 http://securityreason.com/securityalert/2540 http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_SET_REG_SERVER_PROPERTY_RFC_Function_Denial_of_Service.pdf http://www.securityfocus.com/archive/1/464685/100/0/threaded http://www.securityfocus.com/bid/23309 http://www.vupen.com/english/advisories/2007/1270 https://exchange.xforce.ibmcloud.com/vulnerabilities/33418 •
CVSS: 10.0EPSS: 13%CPEs: 13EXPL: 0CVE-2007-1917
https://notcve.org/view.php?id=CVE-2007-1917
Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. Desbordamiento de búfer en la función SYSTEM_CREATE_INSTANCE en la SAP RFC Library 6.40 y 7.00 anterior al 11/12/2006 permite a atacantes remotos ejecutar código de su elección mediante vectores no especificados. NOTA: esta información está basada en revelaciones iniciales imprecisas. • http://secunia.com/advisories/24722 http://securityreason.com/securityalert/2536 http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_SYSTEM_CREATE_INSTANCE_RFC_Function_Buffer_Overflow.pdf http://www.securityfocus.com/archive/1/464683/100/0/threaded http://www.securityfocus.com/bid/23307 http://www.vupen.com/english/advisories/2007/1270 https://exchange.xforce.ibmcloud.com/vulnerabilities/33416 •