Sergio Abraham

The issue allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list. This can lead to the execution of arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.

The issue concerns the DSA algorithm implementation, which does not properly check signatures. This allows remote authenticated users to impersonate arbitrary users via unspecified vectors.

The issue might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape.

The issue allows remote attackers to obtain sensitive TNS information via an unspecified query.

The issue allows remote attackers to execute arbitrary OS commands.

The issue concerns the multi-tenant database container feature in SAP HANA, which fails to properly encrypt communications. This allows remote attackers to bypass intended access restrictions, potentially having other unspecified impacts.

A directory traversal issue allows remote attackers to read arbitrary files.

The issue allows remote attackers to read arbitrary files.

The issue allows remote attackers to write to arbitrary files. This is related to vectors involving the RFC-Gateway.

The issue allows remote attackers to execute arbitrary OS commands with SIDadm privileges.

The issue allows remote attackers to execute arbitrary code due to insufficient input validation. This can be achieved by sending a TrexNet packet to various methods, including `fcopydir`, `fmkdir`, `frmdir`, `getenv`, `dumpenv`, `fcopy`, `fput`, `fdel`, `fmove`, `fget`, `fappend`, `fdir`, `getTraces`, `kill`, `pexec`, `stop`, and `pythonexec`.

The issue is related to the Web Dispatcher service in SAP HANA DB, which lacks protection for service data. This allows remote attackers to potentially obtain passwords by reading web dispatcher and security trace files. The exploitation of this issue may grant unauthorized access to sensitive information.

The issue allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement.

The issue allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue concerns hardcoded credentials in the SAP Web Services Tool, making it easier for remote attackers to gain access through unspecified vectors.

The issue concerns hardcoded credentials in the SAP Open Hub Service, making it easier for remote attackers to gain access through unspecified vectors.