CVE

Id
85002  
CVE No.
CVE-2015-7725  
Status
Candidate  
Description
Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticated users to execute arbitrary SQL commands via the (1) remoteSourceName in the dropCredentials function or unspecified vectors in the (2) setTraceLevelsForXsApps, (3) _modifyUser, or (4) _newUser function, aka SAP Security Notes 2153898 and 2153765.  
Phase
Assigned (20151006)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
751040 85002 CVE-2015-7725 FULLDISC:20150929 [Onapsis Security Advisory 2015-015] SAP HANA SQL injection in _modifyUser function  View
751041 85002 CVE-2015-7725 URL:http://seclists.org/fulldisclosure/2015/Sep/110  View
751042 85002 CVE-2015-7725 FULLDISC:20150929 [Onapsis Security Advisory 2015-016] SAP HANA SQL injection in _newUser function  View
751043 85002 CVE-2015-7725 URL:http://seclists.org/fulldisclosure/2015/Sep/111  View
751044 85002 CVE-2015-7725 FULLDISC:20150929 [Onapsis Security Advisory 2015-018] SAP HANA SQL injection in, setTraceLevelsForXsApps function  View
751045 85002 CVE-2015-7725 URL:http://seclists.org/fulldisclosure/2015/Sep/113  View
751046 85002 CVE-2015-7725 FULLDISC:20150929 [Onapsis Security Advisory 2015-023] SAP HANA Drop Credentials SQL injection  View
751047 85002 CVE-2015-7725 URL:http://seclists.org/fulldisclosure/2015/Sep/118  View
751048 85002 CVE-2015-7725 MISC:http://packetstormsecurity.com/files/133761/SAP-HANA-_modifyUser-SQL-Injection.html  View
751049 85002 CVE-2015-7725 MISC:http://packetstormsecurity.com/files/133762/SAP-HANA-_newUser-SQL-Injection.html  View
751050 85002 CVE-2015-7725 MISC:http://packetstormsecurity.com/files/133764/SAP-HANA-setTraceLevelsForXsApps-SQL-Injection.html  View
751051 85002 CVE-2015-7725 MISC:http://packetstormsecurity.com/files/133769/SAP-HANA-Drop-Credentials-SQL-Injection.html  View
751052 85002 CVE-2015-7725 MISC:https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition  View
751053 85002 CVE-2015-7725 MISC:https://www.onapsis.com/research/security-advisories/sap-hana-drop-credentials-sql-injection  View
751054 85002 CVE-2015-7725 MISC:https://www.onapsis.com/research/security-advisories/sap-hana-sql-injection-modifyuser  View
751055 85002 CVE-2015-7725 MISC:https://www.onapsis.com/research/security-advisories/sap-hana-sql-injection-newuser  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
5660 JVNDB-2015-000184 Void におけるクロスサイトスクリプティングの脆弱性 Void は、オープンソースのコンテンツ管理システム (CMS) です。Void には、クロスサイトスクリプティング (CWE-79) の脆弱性が存在します。 CVE-2015-7777 85002 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-000184.html  View