The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of SAP Sybase Adaptive Server Enterprise

computer vulnerability note CVE-2016-6256

SAP: multiples vulnerabilities of May 2017

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP products.
Impacted products: Business Objects, Crystal Enterprise, SAP ERP, NetWeaver, ASE.
Severity: 2/4.
Creation date: 09/05/2017.
Revisions dates: 12/05/2017, 16/05/2017.
Identifiers: CORE-2017-0001, CVE-2016-6256, ERPSCAN-17-027, ERPSCAN-17-028, VIGILANCE-VUL-22669.

Description of the vulnerability

An attacker can use several vulnerabilities of SAP products.

A detailed analysis was not performed for this bulletin.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability CVE-2017-7691

SAP: multiples vulnerabilities of April 2017

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP products.
Impacted products: SAP ERP, NetWeaver, ASE.
Severity: 4/4.
Creation date: 11/04/2017.
Revisions dates: 12/04/2017, 09/05/2017.
Identifiers: CVE-2017-7691, ERPSCAN-17-016, ERPSCAN-17-017, ERPSCAN-17-018, ERPSCAN-17-019, VIGILANCE-VUL-22410.

Description of the vulnerability

An attacker can use several vulnerabilities of SAP products.

A detailed analysis was not performed for this bulletin.
Complete Vigil@nce bulletin.... (Free trial)

computer vulnerability CVE-2017-6950

SAP: multiples vulnerabilities of March 2017

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP products.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 3/4.
Creation date: 14/03/2017.
Revisions dates: 15/03/2017, 22/03/2017.
Identifiers: CVE-2017-6950, ERPSCAN-17-010, ERPSCAN-17-011, ERPSCAN-17-012, ERPSCAN-17-013, ERPSCAN-17-014, ERPSCAN-17-015, VIGILANCE-VUL-22115.

Description of the vulnerability

An attacker can use several vulnerabilities of SAP products.

A detailed analysis was not performed for this bulletin.
Complete Vigil@nce bulletin.... (Free trial)

computer vulnerability alert CVE-2017-5997 CVE-2017-8913 CVE-2017-8914

SAP: multiples vulnerabilities of February 2017

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP products.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 3/4.
Creation date: 14/02/2017.
Revisions dates: 15/02/2017, 03/03/2017.
Identifiers: CVE-2017-5997, CVE-2017-8913, CVE-2017-8914, CVE-2017-8915, ERPSCAN-17-007, ERPSCAN-17-008, ERPSCAN-17-009, VIGILANCE-VUL-21826.

Description of the vulnerability

An attacker can use several vulnerabilities of SAP products.

A detailed analysis was not performed for this bulletin.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability note CVE-2016-6143 CVE-2016-6818 CVE-2017-7696

SAP: multiples vulnerabilities of January 2017

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP products.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 3/4.
Creation date: 10/01/2017.
Revision date: 11/01/2017.
Identifiers: CVE-2016-6143, CVE-2016-6818, CVE-2017-7696, ERPSCAN-16-036, ERPSCAN-16-037, ERPSCAN-17-001, ERPSCAN-17-002, ERPSCAN-17-003, ERPSCAN-17-004, VIGILANCE-VUL-21534.

Description of the vulnerability

An attacker can use several vulnerabilities of SAP products.

A detailed analysis was not performed for this bulletin.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability announce CVE-2016-10005 CVE-2016-3684 CVE-2016-3685

SAP: multiples vulnerabilities of December 2016

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP products.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 3/4.
Creation date: 13/12/2016.
Identifiers: CVE-2016-10005, CVE-2016-3684, CVE-2016-3685, ERPSCAN-16-041, VIGILANCE-VUL-21362.

Description of the vulnerability

An attacker can use several vulnerabilities of SAP products.

A detailed analysis was not performed for this bulletin.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability announce 14732

SAP: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of SAP, in order to execute JavaScript code in the context of the web site.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 2/4.
Creation date: 13/05/2014.
Revision date: 19/05/2014.
Identifiers: 1979438, DOC-8218, VIGILANCE-VUL-14732.

Description of the vulnerability

The SAP product offers a web service.

However, it does not filter received data before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting of SAP, in order to execute JavaScript code in the context of the web site.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability note CVE-2014-0160

OpenSSL: information disclosure via Heartbeat

Synthesis of the vulnerability

An attacker can use the Heartbeat protocol on an application compiled with OpenSSL, in order to obtain sensitive information, such as keys stored in memory.
Impacted products: Tomcat, ArubaOS, i-Suite, ProxyAV, ProxySG par Blue Coat, SGOS by Blue Coat, ARCserve Backup, ASA, Cisco Catalyst, IOS XE Cisco, Prime Infrastructure, Cisco PRSM, Cisco Router, Cisco CUCM, Cisco IP Phone, Cisco Unity ~ precise, XenDesktop, MIMEsweeper, Clearswift Email Gateway, Clearswift Web Gateway, Debian, ECC, PowerPath, ArcGIS ArcView, ArcGIS for Desktop, ArcGIS for Server, Black Diamond, ExtremeXOS, Summit, BIG-IP Hardware, TMOS, Fedora, FortiClient, FortiGate, FortiGate Virtual Appliance, FortiOS, FreeBSD, HP Diagnostics, LoadRunner, Performance Center, AIX, WebSphere MQ, WS_FTP Server, IVE OS, Juniper J-Series, Junos OS, Junos Pulse, Juniper Network Connect, Juniper SA, Juniper UAC, LibreOffice, MBS, McAfee Email Gateway, ePO, GroupShield, McAfee NGFW, VirusScan, McAfee Web Gateway, Windows 8, Windows RT, MySQL Enterprise, NetBSD, OpenBSD, OpenSSL, openSUSE, Opera, Solaris, pfSense, HDX, RealPresence Collaboration Server, Polycom VBP, Puppet, RHEL, RSA Authentication Manager, SIMATIC, Slackware, Sophos AV, Splunk Enterprise, Stonesoft NGFW/VPN, stunnel, ASE, OfficeScan, Ubuntu, Unix (platform) ~ not comprehensive, ESXi, VMware Player, vCenter Server, VMware vSphere, VMware vSphere Hypervisor, VMware Workstation, Websense Email Security, Websense Web Filter, Websense Web Security.
Severity: 3/4.
Creation date: 08/04/2014.
Identifiers: 1669839, 190438, 2076225, 2962393, c04236102, c04267775, c04286049, CA20140413-01, CERTFR-2014-ALE-003, CERTFR-2014-AVI-156, CERTFR-2014-AVI-161, CERTFR-2014-AVI-162, CERTFR-2014-AVI-167, CERTFR-2014-AVI-169, CERTFR-2014-AVI-177, CERTFR-2014-AVI-178, CERTFR-2014-AVI-179, CERTFR-2014-AVI-180, CERTFR-2014-AVI-181, CERTFR-2014-AVI-198, CERTFR-2014-AVI-199, CERTFR-2014-AVI-213, cisco-sa-20140409-heartbleed, CTX140605, CVE-2014-0160, CVE-2014-0346-REJECT, DSA-2896-1, DSA-2896-2, emr_na-c04236102-7, ESA-2014-034, ESA-2014-036, ESA-2014-075, FEDORA-2014-4879, FEDORA-2014-4910, FEDORA-2014-4982, FEDORA-2014-4999, FG-IR-14-011, FreeBSD-SA-14:06.openssl, Heartbleed, HPSBMU02995, HPSBMU03025, HPSBMU03040, ICSA-14-105-03, JSA10623, MDVSA-2014:123, MDVSA-2015:062, NetBSD-SA2014-004, openSUSE-SU-2014:0492-1, openSUSE-SU-2014:0560-1, openSUSE-SU-2014:0719-1, pfSense-SA-14_04.openssl, RHSA-2014:0376-01, RHSA-2014:0377-01, RHSA-2014:0378-01, RHSA-2014:0396-01, RHSA-2014:0416-01, SA40005, SA79, SB10071, SOL15159, SPL-82696, SSA:2014-098-01, SSA-635659, SSRT101565, USN-2165-1, VIGILANCE-VUL-14534, VMSA-2014-0004, VMSA-2014-0004.1, VMSA-2014-0004.2, VMSA-2014-0004.3, VMSA-2014-0004.6, VMSA-2014-0004.7, VU#720951.

Description of the vulnerability

The Heartbeat extension of TLS (RFC 6520) provides a keep-alive feature, without performing a renegotiation. It exchanges random data in a payload.

Version 1.0.1 of OpenSSL implements Heartbeat, which is enabled by default. The [d]tls1_process_heartbeat() function manages Heartbeat messages. However, it does not check the size of random data, and continues to read after the end of the payload, and then sends the full memory area (up to 64kb) to the peer (client or server).

An attacker can therefore use the Heartbeat protocol on an application compiled with OpenSSL, in order to obtain sensitive information, such as keys stored in memory.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability announce 14262

SAP: multiple vulnerabilities for February 2014

Synthesis of the vulnerability

An attacker can use several vulnerabilities of SAP.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 2/4.
Creation date: 14/02/2014.
Identifiers: 1716640, 1769611, 1771706, 1777988, 1781171, 1833327, 1911319, 1913388, 1915908, 1942332, VIGILANCE-VUL-14262.

Description of the vulnerability

Several vulnerabilities were publicly announced this month by SAP.

An attacker can traverse directories in HFILTAX0_FORMS0_ALV, in order to read a file outside the root path. [severity:2/4; 1913388]

An attacker can traverse directories in HFISTWC0_FORMS, in order to read a file outside the root path. [severity:2/4; 1777988]

An attacker can traverse directories in HFIUTMS0, in order to read a file outside the root path. [severity:2/4; 1771706]

An attacker can traverse directories in HFISTBC0_SUBR, in order to read a file outside the root path. [severity:2/4; 1769611]

An attacker can trigger a Cross Site Scripting in Business Planning and Consolidation, in order to execute JavaScript code in the context of the web site. [severity:2/4; 1942332]

An attacker can bypass access restrictions of ABAP Reports, in order to read or alter data. [severity:2/4; 1911319]

An attacker can bypass access restrictions of ABAP Reports, in order to read or alter data. [severity:2/4; 1716640]

An attacker can bypass access restrictions of ABAP Reports, in order to read or alter data. [severity:2/4; 1915908]

An attacker can invite the victim to click in WebDynpro Java, in order to perform operations. [severity:1/4; 1781171]

An attacker can use a SQL injection in LSZRSF03, in order to read or alter data. [severity:2/4; 1833327]

Other vulnerabilities may have been announced this month, but they are private. SAP has to be contacted to obtain the full list.
Complete Vigil@nce bulletin.... (Free trial)

vulnerability 14260

SAP: code execution via CTC

Synthesis of the vulnerability

An attacker can use the CTC servlet of SAP, in order to execute code.
Impacted products: Business Objects, Crystal Enterprise, Crystal Reports, SAP ERP, NetWeaver, ASE.
Severity: 3/4.
Creation date: 14/02/2014.
Identifiers: 1963100, VIGILANCE-VUL-14260.

Description of the vulnerability

An attacker can use the CTC servlet of SAP, in order to execute code.

Technical details are unknown.
Complete Vigil@nce bulletin.... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about SAP Sybase Adaptive Server Enterprise: