Sap

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-6663 1Sap 1Afaria May 6, 2026 Aug 24, 2015 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note...Show more Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.Show less
CVE-2015-6662 1Sap 1Netweaver May 6, 2026 Aug 24, 2015 N/A· v4 N/A· v3 6.8 MEDIUM· v2 XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
CVE-2015-3621 1Sap 1Enterprise Central Component May 6, 2026 Jul 16, 2015 N/A· v4 N/A· v3 9.3 HIGH· v2 Untrusted search path vulnerability in SAP Enterprise Central Component (ECC) allows local users to gain privileges via a Trojan horse program.
CVE-2015-3449 1Sap 1Afaria May 6, 2026 Jul 16, 2015 N/A· v4 N/A· v3 7.2 HIGH· v2 The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.
CVE-2015-5068 1Sap 1Mobile Platform May 6, 2026 Jun 24, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601.
CVE-2015-5067 1Sap 1Netweaver May 6, 2026 Jun 24, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 The (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors, aka SAP Security Notes 2059659 and 2057982.
CVE-2015-4161 1Sap 1Afaria May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Securit...Show more SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.Show less
CVE-2015-4160 1Sap 1Ase Database Platform May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278.
CVE-2015-4159 1Sap 1Hana Web Based Development Workbench May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes 2153892.
CVE-2015-4158 1Sap 2Netweaver Abap Application Server Netweaver Java Application Server May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2121661.
CVE-2015-4157 1Sap 1Content Server May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security Note 2127995.
CVE-2015-2282 1Sap 6Gui MaxdbNetweaver Abap Application Server+3 more May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java,...Show more Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.Show less
CVE-2015-2278 1Sap 6Gui MaxdbNetweaver Abap Application Server+3 more May 6, 2026 Jun 2, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SD...Show more The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316.Show less
CVE-2015-3995 1Sap 1Hana May 6, 2026 May 29, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565.
CVE-2015-3994 1Sap 1Hana May 6, 2026 May 29, 2015 N/A· v4 N/A· v3 4.0 MEDIUM· v2 The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2...Show more The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818.Show less
CVE-2015-4092 1Sap 1Afaria May 6, 2026 May 26, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, aka SAP Security Note 2153690.
CVE-2015-4091 1Sap 1Sap Netweaver Application Server Java May 6, 2026 May 26, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, r...Show more XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851.Show less
CVE-2015-3981 1Sap 1Netweaver Rfc Sdk May 6, 2026 May 12, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037.
CVE-2015-3980 1Sap 1Customer Relationship Management May 6, 2026 May 12, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.
CVE-2015-3979 1Sap 1Customer Relationship Management May 6, 2026 May 12, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.

Previous 1...666768...79 Next