Sap Hana_database
8 CVEs affecting Sap Hana_database. Latest disclosed: 2026-01-13. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40309 | Critical | 9.8 | 2023-09-12 | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resu… |
CVE-2018-2424 | Critical | 9.8 | 2018-06-12 | SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that… |
CVE-2026-0492 | High | 8.8 | 2026-01-13 | SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining a… |
CVE-2023-40308 | High | 7.5 | 2023-09-12 | SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library w… |
CVE-2019-0350 | High | 7.5 | 2019-11-04 | SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA inst… |
CVE-2021-21474 | Medium | 6.5 | 2021-02-09 | SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for a… |
CVE-2020-26834 | Medium | 5.4 | 2020-12-09 | SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manip… |
CVE-2017-16687 | Medium | 5.3 | 2017-12-12 | The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be mi… |