Vulnerabilities > SAP > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-08-05 | CVE-2016-6140 | Improper Access Control vulnerability in SAP Trex 7.10 SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203591. | 7.6 |
| 2016-08-05 | CVE-2016-6139 | Arbitrary File Read vulnerability in SAP Trex 7.10 SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591. | 7.6 |
| 2016-04-14 | CVE-2016-4018 | Improper Access Control vulnerability in SAP Hana The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality, which allows remote attackers to obtain sensitive information, gain privileges, and conduct unspecified other attacks via unspecified vectors, aka SAP Security Note 2262742. | 7.5 |
| 2016-04-07 | CVE-2016-3974 | XML External Entity Injection vulnerability in SAP Netweaver 7.40 XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994. | 7.5 |
| 2016-02-16 | CVE-2016-2389 | Path Traversal vulnerability in SAP Netweaver 7.40 Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. | 7.8 |
| 2016-02-16 | CVE-2016-2386 | SQL Injection vulnerability in SAP Netweaver 7.40 SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. | 7.5 |
| 2016-01-20 | CVE-2016-1929 | Improper Input Validation vulnerability in SAP Hana The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted HTTP request, related to an unspecified debug function, aka SAP Security Note 2241978. | 8.5 |
| 2016-01-20 | CVE-2016-1928 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in SAP Hana Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP request, related to JSON, aka SAP Security Note 2241978. | 7.5 |
| 2015-12-17 | CVE-2015-8600 | Permissions, Privileges, and Access Controls vulnerability in SAP Mobile Platform The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855. | 7.5 |
| 2015-11-24 | CVE-2015-8330 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in SAP Plant Connectivity The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service (memory corruption and agent crash) via crafted xMII requests, aka SAP Security Note 2238619. | 7.8 |