Sap Hana
38 CVEs affecting Sap Hana. Latest disclosed: 2021-03-09. Critical: 5, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21484 | Critical | 9.8 | 2021-03-09 | LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. |
CVE-2016-6143 | Critical | 9.8 | 2017-04-13 | SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806. |
CVE-2016-6150 | Critical | 9.8 | 2016-08-05 | The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restr… |
CVE-2016-1928 | Critical | 9.8 | 2016-01-20 | Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP re… |
CVE-2016-1929 | Critical | 9.3 | 2016-01-20 | The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process… |
CVE-2016-6144 | High | 8.1 | 2016-08-05 | The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not… |
CVE-2018-2402 | High | 7.6 | 2018-03-14 | In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), us… |
CVE-2018-2465 | High | 7.5 | 2018-09-11 | SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML. By exploiting, an unauthorized hac… |
CVE-2016-6142 | High | 7.5 | 2016-09-26 | SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors related to the SQL prot… |
CVE-2016-6148 | High | 7.5 | 2016-08-05 | SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IM… |
CVE-2016-4017 | High | 7.5 | 2016-04-14 | The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP Se… |
CVE-2016-4018 | High | 7.3 | 2016-04-14 | The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality, which allows remote attackers to obtain sens… |
CVE-2019-0357 | Medium | 6.7 | 2019-09-10 | The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges. |
CVE-2019-0284 | Medium | 6.0 | 2019-04-10 | SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can ca… |
CVE-2018-2369 | Medium | 5.3 | 2018-02-14 | Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can mi… |
CVE-2018-2362 | Medium | 5.3 | 2018-01-09 | A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such… |
CVE-2018-2497 | Low | 2.7 | 2018-12-11 | The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <tabl… |
CVE-2015-7994 | | 2015-11-10 | The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Log… | |
CVE-2015-7993 | | 2015-11-10 | The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via u… | |
CVE-2015-7992 | | 2015-11-10 | SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspe… |