SAP Security Patch Day, May 2015: the CVEs

SAP Security Patch Day May 2015: the CVEs SAP published on 12 May 2015, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Apr 2015, Mar 2015, Feb 2015, Jan 2015, Dec 2014, Nov 2014, Oct 2014, Sep 2014, Aug 2014, Jul 2014, Jun 2014, May 2014. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. –CVE-2015-3981EPSS 1.5%2015-05-12

   SAP NetWeaver RFC SDK allows attackers to obtain sensitive information via unspecified vectors, aka SAP Security Note 2084037.

2. –CVE-2015-3980EPSS 1.4%2015-05-12

   SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.

3. –CVE-2015-3979EPSS 2.4%2015-05-12

   Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.

4. –CVE-2015-3978EPSS 0.4%2015-05-12

   SAP Sybase Unwired Platform Online Data Proxy allows local users to obtain usernames and passwords via the DataVault, aka SAP Security Note 2094830.