Hana Extended Application Services vulnerabilitiesRanked by how likely they are to be used.
Hana Extended Application Services is made by SAP. We track 18 published vulnerabilities in it, across 2 versions. None of them is on the list of flaws known to be exploited today. If you run Hana Extended Application Services, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Hana Extended Application Services vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Hana Extended Application Services's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Hana Extended Application Services flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 2.8%CVE-2014-5173Medium
SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.
- 2.2%CVE-2015-1311Critical
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906.
- 2.1%CVE-2019-0277Medium
SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).
- 1.8%CVE-2019-0266High
Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system.
- 1.7%CVE-2017-16680High
Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are missing user input validation which could allow unprivileged...
- 1.5%
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive...
- 1.2%CVE-2018-2374Medium
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application data like service bindings within that space.
- 1.2%CVE-2018-2451Medium
XS Command-Line Interface (CLI) user sessions with the SAP HANA Extended Application Services (XS), version 1, advanced server may have an unintentional prolonged period of validity.
- 1.1%CVE-2018-2373High
Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver information about system configuration in SAP HANA Extended...
- 0.9%CVE-2018-2375High
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.
Running Hana Extended Application Services? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
SAP HANA Extend Application Services (XS) allows remote attackers to bypass access restrictions via a request to a private IU5 SDK application that was once public.
- Matched to
- Hana Extended Application Services on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 18 published vulnerabilities listed under the name Hana Extended Application Services, across 2 versions.
None of Hana Extended Application Services's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Hana Extended Application Services. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.