CVE-2017-15293

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-152946.1The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.CVE-2017-152959.8Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064.CVE-2017-152968.8The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.CVE-2017-152977.5SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993.CVE-2017-152985.5Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a CVE-2017-152995.5The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which a CVE-2017-15305.4IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav CVE-2017-153005.3The miner statistics HTTP API in EWBF Cuda Zcash Miner Version 0.3.4b hangs on incoming TCP connections until some sort of request is made (CVE-2017-153027.8In CPUID CPU-Z through 1.81, there are improper access rights to a kernel-mode driver (e.g., cpuz143_x64.sys for version 1.43) that can resu CVE-2017-153037.8In CPUID CPU-Z before 1.43, there is an arbitrary memory write that results directly in elevation of privileges, because any program running CVE-2017-153049.8/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cook CVE-2017-153056.1XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.