The SAP Business Intelligence Development Workbench allows remote attackers to obtain sensitive information by reading unspecified files.
Monthly Archives: November 2014
CVE-2014-8664 (environment_health_and_safety)
SQL injection vulnerability in Product Safety (EHS-SAF) component in SAP Environment, Health, and Safety Management allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-8662 (payroll_process)
Unspecified vulnerability in SAP Payroll Process allows remote attackers to cause a denial of service via vectors related to session handling.
CVE-2014-8663 (netweaver_business_warehouse)
SQL injection vulnerability in Data Basis (BW-WHM-DBA) in SAP NetWeaver Business Warehouse allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-8661 (customer_relationship_management_internet_sales)
The SAP CRM Internet Sales module allows remote attackers to execute arbitrary commands via unspecified vectors.
CVE-2014-8660 (document_management_services)
SAP Document Management Services allows local users to execute arbitrary commands via unspecified vectors.
CVE-2014-8668 (contract_accounting)
SQL injection vulnerability in SAP Contract Accounting allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-8659 (environment_health_and_safety)
Directory traversal vulnerability in SAP Environment, Health, and Safety allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2014-8669 (customer_relationship_management)
The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2014-8670 (vbulletin)
Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.