SAP Hana DB vulnerabilities

3 CVEs affecting SAP Hana DB, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-3639, published 2016-09-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3639, published 2016-09-26. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified HTTP request, aka SAP Security Note 2176128.
CVE-2016-6145, published 2016-08-05. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the…
CVE-2016-3640, published 2016-08-05. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.091.00.1418659308 allows local users to obtain sensitive password information via vectors related to passwords in Web…