SAP Sapcryptolib vulnerabilities

2 CVEs affecting SAP Sapcryptolib, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4407, published 2016-10-13.

More from SAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2014-8587, published 2014-11-04. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. SAPCRYPTOLIB before 5.555.38, SAPSECULIB, and CommonCryptoLib before 8.4.30, as used in SAP NetWeaver AS for ABAP and SAP HANA, allows remote attackers to spoof Digital Signature Algorithm (DSA)…
• CVE-2016-4407, published 2016-10-13. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka…