Sap Hana vulnerabilities
28 known vulnerabilities affecting sap/hana.
Total CVEs
28
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH10MEDIUM12LOW3
Vulnerabilities
Page 2 of 2
CVE-2015-6507P4HIGHCVSS 7.2v1.00.091.002015-10-15
CVE-2015-6507 [HIGH] CWE-119 CVE-2015-6507: The hdbsql client 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial
The hdbsql client 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2140700.
nvd
CVE-2015-3995P4MEDIUMCVSS 4.0v1.00.73.00.3891602015-05-29
CVE-2015-3995 [MEDIUM] CWE-200 CVE-2015-3995: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary fil
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565.
nvd
CVE-2015-2072P4MEDIUMCVSS 4.3v1.00.73.00.389160v1.00.80.00.3918612015-02-27
CVE-2015-2072 [MEDIUM] CWE-79 CVE-2015-2072: Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Deve
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or (2) xs/ide/editor/templates/trace/hanaTraceDetailServ
nvd
CVE-2015-3994P4MEDIUMCVSS 4.0v1.00.73.00.3891602015-05-29
CVE-2015-3994 [MEDIUM] CWE-20 CVE-2015-3994: The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389
The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a crafted request, aka SAP Security Note 2109818.
nvd
CVE-2015-7992P4MEDIUMCVSS 4.0v1.00.73.00.3891602015-11-10
CVE-2015-7992 [MEDIUM] CWE-119 CVE-2015-7992: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to the EXECUTE_SEARCH_RULE_SET stored procedure, aka SAP Security Note 2175928.
nvd
CVE-2015-7726P4LOWCVSS 3.5v1.00.091.002015-10-15
CVE-2015-7726 [LOW] CWE-79 CVE-2015-7726: Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in
Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898.
nvd
CVE-2015-7728P4LOWCVSS 3.5v1.00.73.00.3891602015-10-15
CVE-2015-7728 [LOW] CWE-79 CVE-2015-7728: Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in
Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898.
nvd
CVE-2018-2497P4LOWCVSS 2.7v1.0v2.02018-12-11
CVE-2018-2497 [LOW] CVE-2018-2497: The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events
The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE AS SELECT.
nvd
← Previous2 / 2