SAP NetWeaver Rfc SDK vulnerabilities

3 CVEs affecting SAP NetWeaver Rfc SDK, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-2282, published 2015-06-02.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-2282, published 2015-06-02. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver…
• CVE-2015-2278, published 2015-06-02. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver…
• CVE-2015-3981, published 2015-05-12. Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days. SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037.