SAP issues 26 patches to fix denial of service and SQL injection flaws | Computing

"Critical patch update fixes a total of 30 flaws in SAP’s ERP software - SAP has issued a series of 13 patches to fix security flaws exposing customers to the risk of denial of service attacks, cross-site scripting flaws and even a SQL injection flaw.

On top of that, SAP has also updated patches for 13 security flaws that were supposed to have been fixed in last month's SAP patch consignment. 

Other fixed flaws include two directory traversal vulnerabilities and two missing authorization check security flaws. According to ERPSsan, which specializes in analyzing ERP software for security flaws, 14 of the released SAP Security Notes have a ‘high priority' rating and one has what it calls a ‘Hot News' rating. It claims that 559 SAP servers worldwide are at risk of the denial of service vulnerability, with a cluster of vulnerable servers located in London and Ireland. Most, however, are located in India, the US or China." Read more...

Uncovering Risk From SAP HANA Vulnerabilities Can Be Simple and Easy

Uncovering Risk From SAP HANA Vulnerabilities Can Be Simple and Easy: "The latest reports about SAP HANA vulnerabilities reveal some critical vulnerabilities related to authentication, authorizations, patches and misconfigurations, which could make SAP HANA systems a high risk for customers. If any of these known vulnerabilities are exploited, it could result in significant business loss to customers running SAP HANA in applications. Other consequences related to an exploit or data breach include failed compliance, brand reputation impact and declining customer trust resulting in churn."