deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7620
Published: 2015-10-14
Description: The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securitytracker.com/id/1033796; http://www.zerodayinitiative.com/advisories/ZDI-15-496; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
CVE: CVE-2015-7621
Published: 2015-10-14
Description: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://www.securitytracker.com/id/1033796; http://www.zerodayinitiative.com/advisories/ZDI-15-508; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
CVE: CVE-2015-7622
Published: 2015-10-14
Description: Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, and CVE-2015-6695.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033796; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html; https://www.exploit-db.com/exploits/38787/
CVE: CVE-2015-7623
Published: 2015-10-14
Description: The ANAuthenticateResource method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7620.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securitytracker.com/id/1033796; http://www.zerodayinitiative.com/advisories/ZDI-15-510; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
CVE: CVE-2015-7624
Published: 2015-10-14
Description: Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5583, CVE-2015-6705, and CVE-2015-6706.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1033796; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html; http://www.securitytracker.com/id/1033796
CVE: CVE-2015-7625
Published: 2015-10-14
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7626
Published: 2015-10-14
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7627
Published: 2015-10-15
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7628
Published: 2015-10-15
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN22533124/index.html; http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-005234.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html
CVE: CVE-2015-7629
Published: 2015-10-15
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextFormat object with a crafted tabStops property, a different vulnerability than CVE-2015-7631, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7630
Published: 2015-10-15
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7633, and CVE-2015-7634.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7631
Published: 2015-10-15
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextLine object with a crafted validity property, a different vulnerability than CVE-2015-7629, CVE-2015-7643, and CVE-2015-7644.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7632
Published: 2015-10-15
Description: Buffer overflow in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Loader object with a crafted loaderBytes property.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7633
Published: 2015-10-15
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7634.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7634
Published: 2015-10-15
Description: Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7633.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7643
Published: 2015-10-15
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Video object with a crafted deblocking property, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7644.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7644
Published: 2015-10-15
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7643.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00013.html
CVE: CVE-2015-7829
Published: 2015-10-15
Description: Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2[PII_REDACTED]4, and Acrobat and Acrobat Reader DC Continuous before 2[PII_REDACTED]9 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428.
CVSS Score: 1.9 (LOW)
CWE: CWE-119
References: http://www.securitytracker.com/id/1033796; http://www.zerodayinitiative.com/advisories/ZDI-15-465; https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
CVE: CVE-2015-6755
Published: 2015-10-15
Description: The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6756
Published: 2015-10-15
Description: Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6757
Published: 2015-10-15
Description: Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6758
Published: 2015-10-15
Description: The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6759
Published: 2015-10-15
Description: The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalStorage resource is considered unique, which allows remote attackers to obtain sensitive information via vectors involving a blob: URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6760
Published: 2015-10-15
Description: The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-lost events, which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6761
Published: 2015-10-15
Description: The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=dabea74d0e82ea80cd344f630497cafcb3ef872c; http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html
CVE: CVE-2015-6762
Published: 2015-10-15
Description: The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows remote web servers to bypass the Same Origin Policy via a redirect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html; http://www.debian.org/security/2015/dsa-3376
CVE: CVE-2015-6763
Published: 2015-10-15
Description: Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://packetstormsecurity.com/files/134482/Google-Chrome-Integer-Overflow.html; http://rhn.redhat.com/errata/RHSA-2015-1912.html
CVE: CVE-2015-7645
Published: 2015-10-15
Description: Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CVSS Score: 7.8 (HIGH)
References: http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00016.html
CVE: CVE-2015-7834
Published: 2015-10-15
Description: Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/10/stable-channel-update.html; http://www.ubuntu.com/usn/USN-2770-1; http://www.ubuntu.com/usn/USN-2770-2
CVE: CVE-2015-6507
Published: 2015-10-15
Description: The hdbsql client 1.00.091.00 Build[PII_REDACTED]-1530 in SAP HANA allows local users to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2140700.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/133760/SAP-HANA-hdbsql-Memory-Corruption.html; http://seclists.org/fulldisclosure/2015/Sep/109; https://www.onapsis.com/blog/analyzing-sap-security-notes-april-2015-edition
CVE: CVE-2015-7361
Published: 2015-10-15
Description: FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled; http://www.fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled; http://www.securitytracker.com/id/1033093
CVE: CVE-2015-7725
Published: 2015-10-15
Description: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00[PII_REDACTED] allow remote authenticated users to execute arbitrary SQL commands via the (1) remoteSourceName in the dropCredentials function or unspecified vectors in the (2) setTraceLevelsForXsApps, (3) _modifyUser, or (4) _newUser function, aka SAP Security Notes 2153898 and 2153765.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133761/SAP-HANA-_modifyUser-SQL-Injection.html; http://packetstormsecurity.com/files/133762/SAP-HANA-_newUser-SQL-Injection.html; http://packetstormsecurity.com/files/133764/SAP-HANA-setTraceLevelsForXsApps-SQL-Injection.html
CVE: CVE-2015-7726
Published: 2015-10-15
Description: Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00[PII_REDACTED] allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Sep/114; https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition; https://www.onapsis.com/research/security-advisories/sap-hana-xss-role-deletion-through-web-based-workbench
CVE: CVE-2015-7727
Published: 2015-10-15
Description: Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors in the (1) trace configuration page or (2) getSqlTraceConfiguration function, aka SAP Security Note 2153898.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/133766/SAP-HANA-Trace-Configuration-SQL-Injection.html; http://packetstormsecurity.com/files/133768/SAP-HANA-getSqlTraceConfiguration-SQL-Injection.html; http://seclists.org/fulldisclosure/2015/Sep/115
CVE: CVE-2015-7728
Published: 2015-10-15
Description: Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to inject arbitrary web script or HTML via the username, aka SAP Security Note 2153898.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2015/Sep/116; https://www.onapsis.com/blog/analyzing-sap-security-notes-may-2015-edition; https://www.onapsis.com/research/security-advisories/sap-hana-xss-user-creation-through-web-based-development