CVE-2016-6146

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://onapsis.com/research/security-advisories/sap-trex-tns-information-disclosure-nameserverPermissions Required, Third Party Advisory
http://packetstormsecurity.com/files/138445/SAP-TREX-7.10-Revision-63-NameServer-TNS-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://scn.sap.com/community/security/blog/2015/12/09/sap-security-notes-december-2015--reviewVendor Advisory
http://seclists.org/fulldisclosure/2016/Aug/93Third Party Advisory
https://layersevensecurity.com/wp-content/uploads/2016/03/Layer-Seven-Security_SAP-Security-Notes_February-2016.pdfThird Party Advisory
http://onapsis.com/research/security-advisories/sap-trex-tns-information-disclosure-nameserverPermissions Required, Third Party Advisory
http://packetstormsecurity.com/files/138445/SAP-TREX-7.10-Revision-63-NameServer-TNS-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://scn.sap.com/community/security/blog/2015/12/09/sap-security-notes-december-2015--reviewVendor Advisory
http://seclists.org/fulldisclosure/2016/Aug/93Third Party Advisory
https://layersevensecurity.com/wp-content/uploads/2016/03/Layer-Seven-Security_SAP-Security-Notes_February-2016.pdfThird Party Advisory

Timeline

Published: Sep 27, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-61479.8An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via un CVE-2016-61487.5SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vecto CVE-2016-61495.5SAP HANA SPS09 1.00.091.00.14186593 allows local users to obtain sensitive information by leveraging the EXPORT statement to export files, a CVE-2016-61509.8The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass in CVE-2016-61518.8CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vecto CVE-2016-61528.8CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary comm CVE-2016-61535.9os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain se CVE-2016-61546.1The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).CVE-2016-61565.1Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local use CVE-2016-61586.1Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow rem CVE-2016-61597.5The management interface of Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allows remote attackers to bypass authentic CVE-2016-61607.5tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related