HA
Product
Hana
38
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 4Low 1
Watch
Add Hana to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21484 | 9.8 | Mar 9 | LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind Affected: 2.0 |
| CVE-2016-6143 | 9.8 | Apr 13 | SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806 Affected: 1.00.73.00.389160 |
| CVE-2016-6150 | 9.8 | Aug 5 | The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly… Affected: All versions, or not specified |
| CVE-2016-1928 | 9.8 | Jan 20 | Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP request, related to… Affected: All versions, or not specified |
| CVE-2016-1929 | 9.3 | Jan 20 | The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted… Affected: All versions, or not specified |
| CVE-2018-2402 | 8.4 | Mar 14 | In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), user credentials may… Affected: 1.00; 2.00 |
| CVE-2016-6144 | 8.1 | Aug 5 | The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is… Affected: through 1.00.73.00.389160 |
| CVE-2018-2465 | 7.5 | Sep 11 | SAP HANA (versions 1.0 and 2.0) Extended Application Services classic model OData parser does not sufficiently validate XML Affected: 1.0; 2.0 |
| CVE-2016-6142 | 7.5 | Sep 26 | SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors related to the SQL protocol, aka SAP… Affected: 1.00.73.00.389160 |
| CVE-2016-6148 | 7.5 | Aug 5 | SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IMPORT statement, aka… Affected: 1.00.73.00.389160 |
| CVE-2016-4017 | 7.5 | Apr 14 | The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP Security Note 2262710 Affected: All versions, or not specified |
| CVE-2016-4018 | 7.3 | Apr 14 | The Data Provisioning Agent (aka DP Agent) in SAP HANA does not properly restrict access to service functionality, which allows remote attackers to obtain sensitive information,… Affected: All versions, or not specified |
| CVE-2019-0357 | 6.7 | Sep 10 | The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges Affected: 1.0; 2.0 |
| CVE-2019-0284 | 6.0 | Apr 10 | SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source Affected: 1.0; 2.0 |
| CVE-2018-2369 | 5.3 | Feb 14 | Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted Affected: 1.00; 2.00 |
| CVE-2018-2362 | 5.3 | Jan 9 | A remote unauthenticated attacker, SAP HANA 1.00 and 2.00, could send specially crafted SOAP requests to the SAP Startup Service and disclose information such as the platform's… Affected: 1.00; 2.00 |
| CVE-2018-2497 | 2.7 | Dec 11 | The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT Affected: 1.0; 2.0 |
| CVE-2015-7994 | – | Nov 10 | The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP… Affected: 1.00.73.00.389160 |
| CVE-2015-7993 | – | Nov 10 | The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors… Affected: 1.00.73.00.389160 |
| CVE-2015-7992 | – | Nov 10 | SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to… Affected: 1.00.73.00.389160 |
| CVE-2015-7991 | – | Nov 10 | The Web Dispatcher service in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to read web dispatcher and security trace files and possibly obtain passwords… Affected: 1.00.73.00.389160 |
| CVE-2015-7828 | – | Nov 10 | SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet… Affected: through 1.00 |
| CVE-2015-7986 | – | Oct 27 | The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka… Affected: through 1.00.095 |
| CVE-2015-7729 | – | Oct 15 | Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00.1418659308 allows remote authenticated users to execute… Affected: 1.00.091.00 |
| CVE-2015-7728 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users… Affected: 1.00.73.00.389160 |
| CVE-2015-7727 | – | Oct 15 | Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary… Affected: 1.00.73.00.389160 |
| CVE-2015-7726 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject… Affected: 1.00.091.00 |
| CVE-2015-7725 | – | Oct 15 | Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to execute arbitrary SQL… Affected: 1.00.091.00 |
| CVE-2015-6507 | – | Oct 15 | The hdbsql client 1.00.091.00 Build 1418659308-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via… Affected: 1.00.091.00 |
| CVE-2015-3995 | – | May 29 | SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565 Affected: 1.00.73.00.389160 |
| CVE-2015-3994 | – | May 29 | The grant.xsfunc application in testApps/grantAccess/ in the XS Engine in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to spoof log entries via a… Affected: 1.00.73.00.389160 |
| CVE-2015-2072 | – | Feb 27 | Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary… Affected: 1.00.73.00.389160; 1.00.80.00.391861 |
| CVE-2014-8588 | – | Nov 4 | SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 1.00.60.379371 |
| CVE-2014-8587 | – | Nov 4 | SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature… Affected: All versions, or not specified |
| CVE-2014-8314 | – | Oct 16 | Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA Developer Edition Revision 70 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors… Affected: All versions, or not specified |
| CVE-2014-8313 | – | Oct 16 | Eval injection in ide/core/base/server/net.xsjs in the Developer Workbench in SAP HANA allows remote attackers to execute arbitrary XSJX code via unspecified vectors Affected: All versions, or not specified |
| CVE-2014-5172 | – | Jul 31 | Multiple cross-site scripting (XSS) vulnerabilities in the XS Administration Tools in SAP HANA allow remote attackers to inject arbitrary web script or HTML via unspecified… Affected: All versions, or not specified |
| CVE-2014-2749 | – | Apr 10 | The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP… Affected: All versions, or not specified |
Showing 38