SAP^® and Oracle^® Security Advisories

Impact On Business An unauthenticated attacker without specific knowledge of the system can send a specially crafted packet over a network which will trigger an internal error in the system causing the system to crash and rendering it unavailable. Affected Components Description The SAP IGS is a widely-used, server-based engine for generating graphical and non-graphical…

Impact On Business An unauthenticated attacker without specific knowledge of the system can send a specially crafted packet over a network which will trigger an internal error in the system causing the system to crash and rendering it unavailable. Affected Components Description The SAP Gateway server is the component that manages the communication between the…

Impact On Business A high-privileged SAP JAVA NetWeaver user is able to abuse an XXE vulnerability with the goal of reading files from the OS (compromising confidentiality) and/or making system processes crash (compromising availability). Affected Components Description The ESP framework is a framework used inside SAP JAVA NetWeaver. Due to being part of this foundational…

Impact On Business Due to a missing authorization check in SAP Solution Manager LM-SERVICE component a remote authenticated attacker could be able to execute privileged actions in the affected system, including the execution of operating system commands. Affected Components Description A core component of the SAP Solution Manager, LM-SERVICE is affected by this vulnerability. For…

Impact On Business The vulnerability can allow an attacker to inject OS commands and thus gain complete control of the host running the CA Introscope Enterprise Manager. That exploit can be started remotely and does not require authentication or any privileges. Affected Components Description CA Introscope Enterprise Manager is part of CA APM Introscope(R), an…

Impact On Business SAP Hybris accelerator services module is vulnerable to server side request forgery, which means that an authenticated attacker is able to perform POST requests to any valid URL. Affected Components Description SAP Hybris is an ecommerce product platform that is used to address a family of products involving Customer Experience and Management….

Impact On Business An attacker can generate download-links sequentially targeting “impex” directory files. As a consequence, they will be able download most of these files, potentially disclosing critical Hybris information such as credentials. Affected Components Description SAP Hybris is an ecommerce platform that is used to address a family of products involving Customer Experience and…

Impact On Business By abusing a Code Injection in SAP MII, an authenticated user with SAP XMII Developer privileges could execute code (including OS commands) on the server. Thus, they would be able to do everything a SAP Administrator is able to do. Some possible actions are: Access to the SAP databases and read/modify/erase any…

Impact On Business Any authenticated user of the Solution Manager is able to craft/ upload and execute EEM scripts on the SMDAgents affecting its Integrity, Confidentiality and Availability. Affected Components Description SAP SolMan 7.2 introduces a bunch of web services which run on top of the SAP Java NetWeaver stack. The affected versions have a…