Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-6105 State: PUBLISHED Published: 2017-02-01T21:00:00 Last Updated: 2024-08-06T01:22:19.995Z Vendors: IBM Corporation Products: Key Lifecycle Manager Problem Types: Bypass Security Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037763 - http://www.ibm.com/support/docview.wss?uid=swg21997741 - http://www.securityfocus.com/bid/95904
CVE ID: CVE-2016-6110 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T01:22:19.780Z Vendors: IBM Corporation Products: Tivoli Storage Manager Problem Types: Obtain Information Description: IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21996198 - http://www.securityfocus.com/bid/95306
CVE ID: CVE-2016-6111 State: PUBLISHED Published: 2017-03-31T18:00:00 Last Updated: 2024-08-06T01:22:20.742Z Vendors: IBM Corporation Products: Cram Social Program Management Problem Types: Obtain Information Description: IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg22000833 - http://www.securityfocus.com/
Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg22000833 - http://www.securityfocus.com/bid/97244
CVE ID: CVE-2016-6112 State: PUBLISHED Published: 2017-05-22T20:00:00 Last Updated: 2024-08-06T01:22:20.588Z Vendors: IBM Corporation Products: Marketing Platform Problem Types: Gain Privileges Description: IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21992739
CVE ID: CVE-2016-6113 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T01:22:20.775Z Vendors: IBM Corporation Products: Domino Problem Types: Cross-Site Scripting Description: IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94603 - http://www.securitytracker.com/id/1037383 - http://www.ibm.com/support/docview.wss?uid=swg21992835
CVE ID: CVE-2016-6114 State: PUBLISHED Published: 2017-07-12T17:00:00Z Last Updated: 2024-09-16T16:43:44.639Z Vendors: IBM Products: Emptoris Sourcing Problem Types: Cross-Site Scripting Description: IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118352. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg22005549 - https://exchange.xforce.ibmcloud.com/vulnerabilities/118352 - http://www.secur
com/support/docview.wss?uid=swg22005549 - https://exchange.xforce.ibmcloud.com/vulnerabilities/118352 - http://www.securityfocus.com/bid/99545
CVE ID: CVE-2016-6115 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T01:22:20.618Z Vendors: IBM Corporation Products: Spectrum Scale Problem Types: Gain Privileges Description: IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95272 - http://www.ibm.com/support/docview.wss?uid=ssg1S1009639
CVE ID: CVE-2016-6116 State: PUBLISHED Published: 2017-02-02T22:00:00 Last Updated: 2024-08-06T01:22:20.472Z Vendors: IBM Corporation Products: Key Lifecycle Manager Problem Types: Obtain Information Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21997805 - http://www.securityfocus.com/bid/95966
CVE ID: CVE-2016-6117 State: PUBLISHED Published: 2017-02-01T21:00:00 Last Updated: 2024-08-06T01:22:20.241Z Vendors: IBM Corporation Products: Key Lifecycle Manager Problem Types: Obtain Information Description: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21997983 - http://www.securitytracker.com/id/1037764 - http://www.securityfocus.com/bid/95905
CVE ID: CVE-2016-6118 State: PUBLISHED Published: 2017-07-24T21:00:00Z Last Updated: 2024-09-16T19:46:45.985Z Vendors: IBM Products: Emptoris Supplier Lifecycle Management Problem Types: Cross-Site Scripting Description: IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118356. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/118356 - http://www.securityfocus.com/bid/99926 - ht
References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/118356 - http://www.securityfocus.com/bid/99926 - http://www.ibm.com/support/docview.wss?uid=swg22005824
CVE ID: CVE-2016-6121 State: PUBLISHED Published: 2017-08-09T18:00:00Z Last Updated: 2024-09-16T20:36:49.019Z Vendors: IBM Products: Emptoris Supplier Lifecycle Management Problem Types: Cross-Site Scripting Description: IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118383. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/118383 - http://www.ibm.com/support/docview
ontainer: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/118383 - http://www.ibm.com/support/docview.wss?uid=swg22006854 - http://www.securityfocus.com/bid/100222
CVE ID: CVE-2016-6122 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T01:22:19.806Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Obtain Information Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21993982 - http://www.securityfocus.com/bid/94334
CVE ID: CVE-2016-6123 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T01:22:20.565Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Cross-Site Scripting Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94305 - http://www.ibm.com/support/docview.wss?uid=swg21993982
CVE ID: CVE-2016-6124 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T01:22:20.553Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Gain Access Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21993982 - http://www.securityfocus.com/bid/94306
CVE ID: CVE-2016-6125 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T01:22:20.578Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Cross-Site Scripting Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21993982 - http://www.securityfocus.com/bid/94327
CVE ID: CVE-2016-6126 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T01:22:19.892Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Obtain Information Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21993982 - http://www.securityfocus.com/bid/94301
CVE ID: CVE-2016-6127 State: PUBLISHED Published: 2017-07-03T16:00:00 Last Updated: 2024-08-06T01:22:20.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type. Additional Analyst Notes: - CVE Program Container: References: - https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016 - http://www.securityfocus.com/bid/99375 - http://www.debian.org/security/20
rity-vulnerabilities-in-rt-2017-06-15/32016 - http://www.securityfocus.com/bid/99375 - http://www.debian.org/security/2017/dsa-3882
CVE ID: CVE-2016-6128 State: PUBLISHED Published: 2016-08-07T10:00:00 Last Updated: 2024-08-06T01:22:20.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html - http://www.openwall.com/lists/oss-security/2016/06/30/1 - http://www.securityfocus.com/bid/91509 - https://libgd.github.io/release-2.2.3.html - https://bugs.php.net/72494
/30/1 - http://www.securityfocus.com/bid/91509 - https://libgd.github.io/release-2.2.3.html - https://bugs.php.net/72494 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html - http://rhn.redhat.com/errata/RHSA-2016-2750.html - http://www.securitytracker.com/id/1036276 - https://github.com/libgd/libgd/commit/6ff72ae40c7c20ece939afb362d98cc37f4a1c96 - https://security.gentoo.org/glsa/201612-09 - http://www.debian.org/security/2016/dsa-3619 - http://www.ubuntu.com/usn/USN-3030-1 - https://github.com/libgd/libgd/commit/1ccfe21e14c4d18336f9da8515cd17db88c3de61
CVE ID: CVE-2016-6129 State: PUBLISHED Published: 2017-02-13T18:00:00 Last Updated: 2024-08-06T01:22:20.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libtom/libtomcrypt/commit/5eb9743410ce4657e9d54fef26a2ee31a1b5dd0 - https://bugzilla.redhat.com/show_bug.cgi?id=137
.com/libtom/libtomcrypt/commit/5eb9743410ce4657e9d54fef26a2ee31a1b5dd0 - https://bugzilla.redhat.com/show_bug.cgi?id=1370955 - https://www.op-tee.org/advisories/
CVE ID: CVE-2016-6130 State: PUBLISHED Published: 2016-07-03T21:00:00 Last Updated: 2024-08-06T01:22:20.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/532c34b5fbf1687df63b3fcd5b2846312ac943c6 - http://www.debian.org/security/2016/dsa-3616 - http://www.securityfocus.com/bid/91540 - http://www.securityfocus.com/archive/1/
www.debian.org/security/2016/dsa-3616 - http://www.securityfocus.com/bid/91540 - http://www.securityfocus.com/archive/1/538803/30/0/threaded - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=532c34b5fbf1687df63b3fcd5b2846312ac943c6 - https://bugzilla.kernel.org/show_bug.cgi?id=116741
CVE ID: CVE-2016-6131 State: PUBLISHED Published: 2017-02-07T15:00:00 Last Updated: 2024-08-06T01:22:20.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types. Additional Analyst Notes: - CVE Program Container: References: - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71696 - http://www.openwall.com/lists/oss-security/2016/06/30/4 - http://www.securityfocus.com/bid/91519 - http://www.openwall.com/lists/oss-security/2016/06/30/7 - https://gcc.gnu.org/ml/gcc-patches/2016-06/msg02030.html
CVE ID: CVE-2016-6132 State: PUBLISHED Published: 2016-08-12T15:00:00 Last Updated: 2024-08-06T01:22:20.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html - https://libgd.github.io/release-2.2.3.html - http://www.openwall.com/lists/oss-security/2016/06/30/6 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html - http://www.ubuntu.com/usn/USN-3060-1 - http
06/30/6 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html - http://www.ubuntu.com/usn/USN-3060-1 - https://github.com/libgd/libgd/issues/247 - https://security.gentoo.org/glsa/201612-09 - http://www.securityfocus.com/bid/91520 - http://www.openwall.com/lists/oss-security/2016/06/30/10 - http://www.debian.org/security/2016/dsa-3619
CVE ID: CVE-2016-6133 State: PUBLISHED Published: 2017-07-25T20:00:00 Last Updated: 2024-08-06T01:22:20.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/540742/100/0/threaded
CVE ID: CVE-2016-6136 State: PUBLISHED Published: 2016-08-06T20:00:00 Last Updated: 2024-08-06T01:22:19.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91558 - https://github.com/linux-audit/audit-kernel/issues/18 - http://rhn.redhat.com/errata/RHSA-2016-2584.html - http://rhn.redhat.com/errata/RHSA-2016-2574.h
udit-kernel/issues/18 - http://rhn.redhat.com/errata/RHSA-2016-2584.html - http://rhn.redhat.com/errata/RHSA-2016-2574.html - https://github.com/torvalds/linux/commit/43761473c254b45883a64441dd0bc85a42f3645c - https://bugzilla.kernel.org/show_bug.cgi?id=120681 - https://bugzilla.redhat.com/show_bug.cgi?id=1353533 - https://source.android.com/security/bulletin/2016-11-01.html - http://www.securityfocus.com/archive/1/538835/30/0/threaded - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=43761473c254b45883a64441dd0bc85a42f3645c - http://rhn.redhat.com/errata/RHSA-2017-0307.html
CVE ID: CVE-2016-6137 State: PUBLISHED Published: 2016-09-27T15:00:00 Last Updated: 2024-08-06T01:22:19.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Aug/85 - http://onapsis.com/research/security-advisories/sap-trex-remote-command-execution - http://packetstormsecurity.com/files/138436/SAP-TREX-7.10-Revision-63-Remote-Command-Execution.html - http://seclists.org/fulldisclosure/2016/Aug/113
CVE ID: CVE-2016-6138 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-06T01:22:20.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591. Additional Analyst Notes: - CVE Program Container: References: - http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-october-2015--review - https://layersevensecurity.com/wp-content/uploads/2015/11/Layer-Seven-Security_SAP-Security-Notes_October-2015.pdf - http://packetstormsecurity.com/files/138437/SAP-TREX-7.10-Revision-63-Directory-Travers
ecurity-Notes_October-2015.pdf - http://packetstormsecurity.com/files/138437/SAP-TREX-7.10-Revision-63-Directory-Traversal.html - https://www.onapsis.com/research/security-advisories/sap-trex-remote-directory-traversal - http://www.securityfocus.com/bid/92060 - http://seclists.org/fulldisclosure/2016/Aug/114 - http://seclists.org/fulldisclosure/2016/Aug/86 - https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
CVE ID: CVE-2016-6139 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-06T01:22:20.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/138438/SAP-TREX-7.10-Revision-63-Remote-File-Read.html - http://www.securityfocus.com/bid/92063 - https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015 - http://seclists.org/fulldisclosure/2016/Aug/115 - http://seclists.org/fulldisclosure/2016/Aug/87 - https://www.onapsis.com/resear
clists.org/fulldisclosure/2016/Aug/115 - http://seclists.org/fulldisclosure/2016/Aug/87 - https://www.onapsis.com/research/security-advisories/sap-trex-remote-file-read
CVE ID: CVE-2016-6140 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-06T01:22:20.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203591. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/138439/SAP-TREX-7.10-Revision-63-Arbitrary-File-Write.html - https://www.onapsis.com/research/security-advisories/sap-trex-arbitrary-file-write - http://seclists.org/fulldisclosure/2016/Aug/88 - http://www.securityfocus.com/bid/92069 - https://www.onapsis.com/blog/analyzing-sap-securi
/fulldisclosure/2016/Aug/88 - http://www.securityfocus.com/bid/92069 - https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
CVE ID: CVE-2016-6142 State: PUBLISHED Published: 2016-09-26T16:00:00 Last Updated: 2024-08-06T01:22:20.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors related to the SQL protocol, aka SAP Security Note 2197459. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/138441/SAP-HANA-DB-1.00.73.00.389160-SAP-Protocol-Audit-Injection.html - http://seclists.org/fulldisclosure/2016/Aug/89 - http://www.securityfocus.com/bid/92566 - http://onapsis.com/research/security-advisories/sap-hana-arbitrary-audi
ug/89 - http://www.securityfocus.com/bid/92566 - http://onapsis.com/research/security-advisories/sap-hana-arbitrary-audit-injection-sql-protocol
CVE ID: CVE-2016-6143 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T01:22:20.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92062 - https://layersevensecurity.com/wp-content/uploads/2015/11/Layer-Seven-Security_SAP-Security-Notes_October-2015.pdf - https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
CVE ID: CVE-2016-6144 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-06T01:22:20.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869. Additional Analyst Notes: - CVE Program Container: References: - https://www.onapsis.com/research/security-advisories/sap-hana-system-user-brute-force-attack - https://www.onapsis.com/blog/onapsis-publishes-1
/research/security-advisories/sap-hana-system-user-brute-force-attack - https://www.onapsis.com/blog/onapsis-publishes-15-advisories-sap-hana-and-building-components - http://www.securityfocus.com/bid/92065 - http://seclists.org/fulldisclosure/2016/Aug/91 - http://packetstormsecurity.com/files/138443/SAP-HANA-DB-1.00.73.00.389160-SYSTEM-User-Brute-Force.html