Sybase vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2013-7245 The Backup Server component in SAP Sybase ASE 15.7 before SP51 allows remote attackers to bypass access restrictions and perform database dumps by leveraging faHigh 7.5 · Apr 24, 2018
• CVE-2017-5371 Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of crafted requests, aHigh 7.5 · Jan 23, 2017
• CVE-2016-7402 SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc imCritical 9.8 · Nov 3, 2016
• CVE-2014-6284 SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the challenge and response mechanism and obtaHigh 7.5 · Jun 8, 2015
• CVE-2015-1310 SQL injection vulnerability in SAP Adaptive Server Enterprise (Sybase ASE) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, akHigh 7.5 · Jan 22, 2015
• CVE-2013-6868 SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows local users tHigh 7.8 · Nov 23, 2013
• CVE-2013-6867 Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 before 15.7 SP50 or 15.7 SP100 allows remote attackers to cause a denial of servicHigh 7.1 · Nov 23, 2013
• CVE-2013-6866 SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticatedHigh 9 · Nov 23, 2013
• CVE-2013-6865 SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenHigh 9 · Nov 23, 2013
• CVE-2013-6863 SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenHigh 9 · Nov 23, 2013
• CVE-2013-6862 Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP10High 7.8 · Nov 23, 2013
• CVE-2013-6859 SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3.High 8.5 · Nov 23, 2013
• CVE-2013-6245 Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3.High 10 · Oct 23, 2013
• CVE-2011-2475 Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server and DMZ Proxy in Sybase OneBridge MobileHigh 10 · Jun 9, 2011
• CVE-2011-0497 Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allowsHigh 7.8 · Jan 20, 2011
• CVE-2011-0496 Unspecified vulnerability in Sybase EAServer 5.x and 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allowsHigh 10 · Jan 20, 2011
• CVE-2008-0912 Multiple heap-based buffer overflows in mlsrv10.exe in Sybase MobiLink 10.0.1.3629 and earlier, as used by SQL Anywhere Developer Edition 10.0.1.3415 and probabHigh 10 · Feb 22, 2008
• CVE-2006-3667 Unspecified vulnerability in Sybase/Financial Fusion Consumer Banking Suite versions before 20060706 has unknown impact and remote attack vectors.High 10 · Jul 18, 2006
• CVE-2005-0441 Multiple stack-based buffer overflows in Sybase Adaptive Server Enterprise (ASE) 12.x before 12.5.3 ESD#1 allow remote authenticated users to execute arbitrary High 10 · Dec 22, 2004
• CVE-2002-2250 Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter to the xp_freedll exHigh 10 · Dec 31, 2002