Sergio Abraham

**Name of the Vulnerable Software and Affected Versions** SAP Netweaver version 7.4 **Description** The issue allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list. This can lead to the execution of arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly. **Recommendations** For SAP Netweaver version 7.4, apply the fix provided in SAP Security Note 2139366 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP SAPCRYPTOLIB version 5.555.38 **Description** The issue concerns the DSA algorithm implementation, which does not properly check signatures. This allows remote authenticated users to impersonate arbitrary users via unspecified vectors. **Recommendations** For SAP SAPCRYPTOLIB version 5.555.38, update to a version that properly checks signatures to prevent impersonation.

**Name of the Vulnerable Software and Affected Versions** SAP NetWeaver 2004s versions 7.00 SP Level 0031 **Description** The issue might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape. **Recommendations** For SAP NetWeaver 2004s version 7.00 SP Level 0031, apply the fix as described in SAP Security Note 2190621 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP TREX version 7.10 Revision 63 **Description** The issue allows remote attackers to obtain sensitive TNS information via an unspecified query. **Recommendations** For SAP TREX version 7.10 Revision 63, apply the fix provided in SAP Security Note 2234226 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP TREX version 7.10 Revision 63 **Description** The issue allows remote attackers to execute arbitrary OS commands. **Recommendations** For SAP TREX version 7.10 Revision 63, apply the fix provided in SAP Security Note 2203591 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP HANA (affected versions not specified) **Description** The issue concerns the multi-tenant database container feature in SAP HANA, which fails to properly encrypt communications. This allows remote attackers to bypass intended access restrictions, potentially having other unspecified impacts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP TREX version 7.10 Revision 63 **Description** A directory traversal issue allows remote attackers to read arbitrary files. **Recommendations** For SAP TREX version 7.10 Revision 63, apply the fix as described in SAP Security Note 2203591 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP TREX version 7.10 Revision 63 **Description** The issue allows remote attackers to read arbitrary files. **Recommendations** For SAP TREX version 7.10 Revision 63, apply the fix provided in SAP Security Note 2203591 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP TREX version 7.10 Revision 63 **Description** The issue allows remote attackers to write to arbitrary files. This is related to vectors involving the RFC-Gateway. **Recommendations** For SAP TREX version 7.10 Revision 63, apply the fix provided in SAP Security Note 2203591 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP TREX version 7.10 Revision 63 **Description** The issue allows remote attackers to execute arbitrary OS commands with SIDadm privileges. **Recommendations** For SAP TREX version 7.10 Revision 63, apply the fix provided in SAP Security Note 2234226 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SAP HANA Database version 1.00 SPS10 and earlier **Description** The issue allows remote attackers to execute arbitrary code due to insufficient input validation. This can be achieved by sending a TrexNet packet to various methods, including `fcopydir`, `fmkdir`, `frmdir`, `getenv`, `dumpenv`, `fcopy`, `fput`, `fdel`, `fmove`, `fget`, `fappend`, `fdir`, `getTraces`, `kill`, `pexec`, `stop`, and `pythonexec`. **Recommendations** For SAP HANA Database version 1.00 SPS10 and earlier, consider disabling the affected methods until a patch is available. Restrict access to the TrexNet packet handling functionality to minimize the risk of exploitation. Avoid using the vulnerable functions in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP HANA DB version 1.00.73.00.389160 **Description** The issue is related to the Web Dispatcher service in SAP HANA DB, which lacks protection for service data. This allows remote attackers to potentially obtain passwords by reading web dispatcher and security trace files. The exploitation of this issue may grant unauthorized access to sensitive information. **Recommendations** For SAP HANA DB version 1.00.73.00.389160, consider restricting access to the Web Dispatcher service as a temporary workaround until a patch is available. Additionally, review the security configurations to ensure that service data is properly protected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP HANA DB version 1.00.73.00.389160 **Description** The issue allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement. **Recommendations** For SAP HANA DB version 1.00.73.00.389160, consider restricting access to the IMPORT FROM SQL statement until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SAP HANA Extend Application Services (XS) (affected versions not specified) **Description** The issue allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP Web Services Tool (CA-WUI-WST) (affected versions not specified) **Description** The issue concerns hardcoded credentials in the SAP Web Services Tool, making it easier for remote attackers to gain access through unspecified vectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SAP Open Hub Service (affected versions not specified) **Description** The issue concerns hardcoded credentials in the SAP Open Hub Service, making it easier for remote attackers to gain access through unspecified vectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.