Hana (Sap) - vulnerabilities (CVEs)

37 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2021-03-09. Vendor: Sap.

CVEs of Hana

CVE-2021-21484 - CVSS 9.8 (critical), 2021-03-09: LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind.
CVE-2019-0357 - CVSS 6.7 (medium), 2019-09-10: The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges.
CVE-2019-0284 - CVSS 6 (medium), 2019-04-10: SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can…
CVE-2018-2497 - CVSS 2.7 (low), 2018-12-11: The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE…
CVE-2018-2465 - CVSS 7.5 (high), 2018-09-11: SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized…
CVE-2018-2402 - CVSS 8.4 (high), 2018-03-14: In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay),…
CVE-2018-2369 - CVSS 5.3 (medium), 2018-02-14: Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can…
CVE-2018-2362 - CVSS 5.3 (medium), 2018-01-09: A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such…
CVE-2016-6143 - CVSS 9.8 (critical), 2017-04-13: SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806.
CVE-2016-6142 - CVSS 7.5 (high), 2016-09-26: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors related to the SQL…
CVE-2016-6150 - CVSS 9.8 (critical), 2016-08-05: The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access…
CVE-2016-6148 - CVSS 7.5 (high), 2016-08-05: SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an…
CVE-2016-6144 - CVSS 8.1 (high), 2016-08-05: The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is…
CVE-2016-4018 - CVSS 7.3 (high), 2016-04-14: The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality, which allows remote attackers to obtain…
CVE-2016-4017 - CVSS 7.5 (high), 2016-04-14: The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP…
CVE-2016-1929 - CVSS 9.3 (critical), 2016-01-20: The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process…
CVE-2016-1928 - CVSS 9.8 (critical), 2016-01-20: Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP…
CVE-2015-7994 - CVSS 7.5 (high), 2015-11-10: The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL…
CVE-2015-7993 - CVSS 7.5 (high), 2015-11-10: The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via…
CVE-2015-7992 - CVSS 4 (medium), 2015-11-10: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via…
CVE-2015-7991 - CVSS 5 (medium), 2015-11-10: The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and…
CVE-2015-7828 - CVSS 10 (critical), 2015-11-10: SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other…
CVE-2015-7986 - CVSS 7.5 (high), 2015-10-27: The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
CVE-2015-7729 - CVSS 6.5 (medium), 2015-10-15: Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00.1418659308 allows remote authenticated…
CVE-2015-7727 - CVSS 6.5 (medium), 2015-10-15: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users…
CVE-2015-7728 - CVSS 3.5 (low), 2015-10-15: Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote…
CVE-2015-7726 - CVSS 3.5 (low), 2015-10-15: Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote…
CVE-2015-7725 - CVSS 6.5 (medium), 2015-10-15: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to…
CVE-2015-6507 - CVSS 7.2 (high), 2015-10-15: The hdbsql client 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have…
CVE-2015-3995 - CVSS 4 (medium), 2015-05-29: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note…
CVE-2015-3994 - CVSS 4 (medium), 2015-05-29: The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to…
CVE-2015-2072 - CVSS 4.3 (medium), 2015-02-27: Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote…
CVE-2014-8588 - CVSS 7.5 (high), 2014-11-04: SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-8587 - CVSS 7.5 (high), 2014-11-04: SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to…
CVE-2014-8313 - CVSS 6 (medium), 2014-10-16: Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified…
CVE-2014-8314 - CVSS 4.3 (medium), 2014-10-16: Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML…
CVE-2014-5172 - CVSS 4.3 (medium), 2014-07-31: Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML…
CVE-2014-2749 - CVSS 5 (medium), 2014-04-10: The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information…