CVE-2015-7986
HighSummary
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request.
Risk Assessment
An attacker could exploit this vulnerability to gain control over the system or disrupt its operation, potentially leading to serious consequences for the organization.
Recommendation
It is recommended to update to the latest version of SAP HANA and monitor HTTP traffic for potential attacks.
Other vulnerabilities in SAP HANA 1.00.095
See all- CVE-2026-0492High
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.
- CVE-2016-6144High
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as 'False'. This makes it easier for remote attackers to bypass authentication via a brute force attack.
- CVE-2015-1311High
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors.
- CVE-2014-8588High
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-6150Critical
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
- CVE-2016-1929Critical
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.
Original NVD description (English source)
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428.