The SAP Product Security Response Team thanks all researchers and security IT professionals that helped with discovering and solving security vulnerabilities. Their findings have helped SAP to maintain the security and safety of its customers' and partners' SAP systems.
Our acknowledgements page lists those professionals we have worked with successfully in the past. We thank all security researchers for their excellent work and hope to continue the fruitful relationship between security professionals and SAP.
For the current month's acknowledgments, visit the acknowledgments home page.
For acknowledgements previous to 2014 , visit the acknowledgments archive (2011 to 2013) page.
The SAP Product Security Response Team thanks all researchers and security IT professionals that help with discovering and solving security vulnerabilities. Their findings continuously help SAP maintain the security and safety of its customers' and partners' SAP systems.
Our acknowledgements page lists those professionals we have worked with successfully in the past. We thank all security researchers for their excellent work and hope to continue the beneficial relationship between security professionals and SAP.
Security researchers who have helped SAP to improve the security and integrity of our customers' IT systems by respecting our disclosure guidelines this month are:
February 2019
Onapsis, Gaston Traberg, Nahuel D. Sanchez, Pablo Artuso, Sebastian Bortnik, Yvan Genuer
January 2019
NCC Group, David Cash
HMMH, Sven Scheil
Onapsis, Yvan GENUER
December 2018
AppCheck, Gary O’Leary-Steele
Infoziant, Vasantha Kumar.S.P.
Onapsis, Matías Sena, Yvan GENUER
Red Database Security, Alexander Kornbrust
November 2018
ERP-SEC, Joris van de Vis
ING Tech Poland, Pawel Gocyla
Onapsis, Gaston Traberg, Yvan Genuer
October 2018
Biznet Bilisim A.S, Deniz CEVIK
Harikrishnan R
September 2018
Dennis Antunes
EPAM Systems, Dzmitry Savitski
Kirtikumar Anandrao Ramchandani
Lav Srivastav
Maen Abu Tabanjeh
Pristine InfoSolutions Pvt LTD, Mohd Maroof
Oliver Hough
Onapsis, Martín Doyhenard
Robert Wiggins
Sébastien Kaul
Viettel Cyber Security, An Phuoc Trinh
Waqas Ahmed
August 2018
Biznet Bilisim, Deniz Cevik
Deloitte Germany, Alhamzah Al-Mersoumi
ERP-SEC, Joris van de Vis
Lambert Boskamp
Onapsis, Gaston Traberg, Pablo Artuso
Virtual Forge, Thomas Fritsch
Vyshnav NK
July 2018
KoçSistem, Emre BÖLÜK, Hakkı YÜCE, Koray Emre KISA
Onapsis, Gaston Traberg
Sara Badran
Yvan Genuer
June 2018
2NS - Second Nature Security, Juho Nurminen
May 2018
Asconsit LLC, Matthew Pollicove
Lambert Boskamp
Quantum Leap, Riccardo Di Pietro
Trend Micro's Zero Day Initiative, rgod
Yvan Genuer
April 2018
Kirtikumar Anandrao Ramchandani
Onapsis, Nicolás Raus, Pablo Artuso
Synacktiv, Sebastien Dudek, Thomas Chauchefoin
March 2018
Devoteam, Yvan Genuer
ERPScan, Mathieu Geli, Vahagn Vardanyan
Onapsis, Gaston Traberg
Piyush Kumar
Positive Technologies, Alexandr Shvetsov
WIBF, Waleed Ezz Eldin
February 2018
Devoteam, Yvan Genuer
EnterpriseAlumni, James Sinclair
ERPScan, Mathieu Geli, Vahagn Vardanyan, Vladimir Egorov
Onapsis, Gaston Traberg, Nahuel D. Sánchez, Martin Doyhenard, Pablo Artuso
January 2018
ERP-SEC, Joris Van De Vis
Onapsis, Andrés Blanco, Matias E. Sena, Nahuel D. Sánchez
December 2017
ERPScan, Mikhail Medvedev
Onapsis, Andrés Blanco, Matias E. Sena, Nahuel D. Sánchez, Pablo Artuso,
Positive Technologies, Mikhail Klyuchnikov, Shvetsov Alexandr
November 2017
Core Security, Martin Gallo
ERPScan, Mathieu Geli, Vahagn Vardanyan, Vladimir Egorov
Fortinet, Kushal Arvind Shah
Gruppo Finmatica, Alessandro Cavaliere
Onapsis, Nahuel D. Sánchez
October 2017
Ernst & Young (Hacktics Advanced Security Center), Sagi Cohen
ERPScan, Vahagn Vardanyan
Lufthansa Industry Solutions, Timo Thräm
Onapsis, Andres Blanco, Emiliano Fausto, Nahuel D. Sánchez
Positive Technologies, Alexandr Shvetsov
TZI of the Universität Bremen, Daniel Müller, Karsten Sohr
September 2017
2NS - Second Nature Security, Juho Nurminen
ERPScan, Abubakirov Nursultan
SEC Consult Vulnerability Lab, Marc Nimmerrichter
August 2017
Dionisia Lerataki
Ernst & Young (Hacktics Advanced Security Center), Sagi Cohen
ERPScan, Vahagn Vardanyan, Vladimir Egorov
ERP-SEC, Joris Van De Vis
Konstantinos Alexiou
Onapsis, Mathias Mevied
Positive Technologies, Alexandr Shvetsov
July 2017
Ernst & Young (Hacktics Advanced Security Center), Bill Ben-Haim, Yaniv Baruch
ERP-SEC, Joris Van De Vis
ERPScan, Dmitry Chastuhin, Mathieu Geli, Vladimir Egorov
Onapsis, Andrés Blanco, Nahuel D. Sánchez, Pablo Artuso
Portcullis Advisories, Oliver Gruskovnjak
Sandeep Singh Jadon
UST Global Inc, Adarsh S V Nair
June 2017
Cisco Systems, Inc., Tim Wadhwa-Brown
ERPScan, Mathieu Geli, Nursultan Abubakirov, Vahagn Vardanyan
ERP-SEC, Joris Van De Vis
Extreme Hacking, Sadik Shaikh
Onapsis, Alejandro Burzyn, Andrés Blanco, Nahuel D. Sánchez, Martin Doyhenard
UST Global Inc., Adarsh S V Nair, Hemanth Joseph
May 2017
Quenta Solutions, Sergiu Popa
Core Security, Martin Gallo, Maximiliano Vidal
Ernst & Young (Hacktics Advanced Security Center), Adi Belinkov
ERPScan, Dmitry Chastuhin, Dmitry Yudin, Vahagn Vardanyan
Extreme Hacking, Sadik Shaikh
Garage4hackers, Nikhil Mittal
Philippine Cyber Army, Jolan Saluria
Onapsis, Julian Rapisardi, Sebastian Bortnik, Sergio Abraham
Positive Technologies, Poneev Roman
April 2017
AMINE HM
Anton Mihaita Adrian
ERPScan, Mathieu Geli, Vahagn Vardanyan
ERP-SEC, Joris Van De Vis
Guilherme Cesar Leite
Percept Ltd., Martin Maruskin
Positive Technologies, Michael Stepankin, Mikhail Klyuchnikov, Shvetsov Alexander
SAPtech ERP Consulting Pty. Ltd, Peter Baris
w4rri0r, Abhinav Karnawat
March 2017
Devoteam, Yvan Genuer
ERPScan, Boris Sanin, Dmitry Chastuhin, Dmitry Yudin, Mathieu Geli, Vahagn Vardanyan
Fortinet, Kushal Arvind Shah
ImpactX Technologies, Kamran Saifullah
Onapsis, Andrés Blanco, Emiliano Fausto, Martin Doyhenard, Nahuel D. Sánchez, Sebastian Bortnik, Sergio Abraham
Positive Technologies, Egor Dimitrenko, Michael Stepankin, Mikhail Klyuchnikov
Vodafone Group Services Ltd., Viktor Gazdag
February 2017
Deloitte & Touché, Ivan Nagornov
ERPScan, Mathieu Geli, Mikhail Medvedev
Fortinet, Kushal Arvind Shah
Onapsis, Emiliano Fausto, Matias Mevied, Pablo Artuso
Pentos AG, Anamarija Crncic-Samsa
Positive Technologies, Poneev Roman
January 2017
Bug Bounty Hunter
ERPScan, Mathieu Geli, Vahagn Vardanyan
Onapsis, Julian Rapisardi, Sebastian Bortnik, Sergio Abraham
Positive Technologies, Egor Dimitrenko, Mikhail Klyuchnikov, Poneev Roman, Yury Aleynov
Trustwave, Martin Rakhmanov
Xiting, Julius Bussche
December 2016
ERNW GmbH, Oliver Matula
ERPScan, Mathieu Geli
ERP Security, Joris Van De Vis
Huzaifa Tahir
MHR, David Mold, Martyn Kemp, Robert Taylor
Onapsis, Emiliano Fausto, Nahuel D. Sánchez, Sergio Abraham
Willy Gaston Lindo
November 2016
Deloitte Risk Advisory B.V., Sander Maas & Dima van de Wouw
ERPScan, Aleksey Tyurin, Mathieu Geli
ERP Security, Joris Van De Vis
Onapsis, Pablo Artuso
October 2016
ERPScan, Vahagn Vardanyan
ERP Security, Joris Van De Vis
Onapsis, Gaston Traberg, Matias Mevied
Ahmad Amjad Alfoqha'a
Quenta Solutions , Sergiu Popa
Kristoffer Naterstad Seljestad
September 2016
ERPScan, Roman Bezhan
Manuel Eve A. Laude
Muhammad Amr Nasef
Onapsis, Nahuel D. Sánchez
Sucuri Inc, Djoukhrab Djaber
Trustwave, Martin Rakhmanov
August 2016
Abishek Shroti
Ajeeth Rakkapan
Core Security , Martin Gallo
Coriant , Frank Biermann
Devoteam , Genuer Yvan
Djaballah Mohamed Taher
ERPScan , Daria Prosochkina, Mathieu Geli, Vahagn Vardanyan
Hisham Mir
Onapsis , Sergio Abraham
July 2016
Disha Institute of Management and Technology, Yogendra Jaiswal
ERPScan , Dmitry Yudin, Mathieu Geli, Vahgan Vardanyan
ERP Security , Joris Van De Vis
Trustwave , Martin Rakhmanov
Vodafone Group Services Ltd. , Viktor Gazdag
June 2016
Compass Security Schweiz AG , Damian Pfammatter
ERPScan , Alexander Polyakov, Nursultan Abubakirov, Vahgan Vardanyan
ERP Security , Joris Van De Vis
Evolution Security GmbH - Government Laboratory , SaifAllah benMassaoud
Onapsis , Juan Perez-Etchegoyen, Sergio Abraham
Philips India ltd, Makkena Narendra
May 2016
Accenture, Vinothpkumar
Biznet , Can Demirel
DTS Solution , Mohamed Osman Saeed
Edis Konstantini
ERPScan , Aleksey Tyurin, Vahgan Vardanyan
Trustwave , Martin Rakhmanov
April 2016
0xlabs , Jose Carlos Exposito Bueno
Center for Computing Technologies at the Universität Bremen (TZI) , Karsten Sohr
ERPScan, Nursultan Abubakirov, Vahgan Vardanyan
Onapsis , Juan Perez-Etchegoyen, Nahuel D. Sánchez, Sergio Abraham
Pen Test Partners , Jamie Riden
Trustwave , Martin Rakhmanov
March 2016
Biznet Bilisim , Deniz Cevik
Core Security, Martin Gallo
ERNW GmbH, Wojtek Przibylla
ERPScan, Dmitry Chastuchi, Dmitry Yudin, Vahagn Vardanyan
Hyundai AutoEver Europe GmbH, Ashar Javed
Onapsis, Pablo Artuso
Second Nature Security, Juho Ranta
Vodafone Group, Viktor Gazdag
February 2016
Biznet Bilisim, Deniz Cevik
ERPScan, Dmitry Chastuhin, Vahagn Vardanyan
ERPSecurity , Joris van de Vis
Hyundai AutoEver Europe GmbH , Ashar Javed
Jay Jani
Lawrence Amer
Onapsis, Emiliano Jose Fausto, Fernando Russ, Pablo Muller
Philips India. Ltd., Makkena Narendra
January 2016
Dipen Bharat Patel
ERPScan , Mathieu Geli, Vahagn Vardanyan
ERPSecurity , Joris van de Vis
Hyundai AutoEver Europe GmbH , Ashar Javed
Maads Security , Muhammad Shahmeer Amir
Onapsis, Juan Perez-Etchegoyen, Nahuel D. Sánchez
Positive Research Center, Dmitry Sklyarov, Dmitry Gutsko, Vyacheslav Mavlyanov
Werth IT, Thomas Werth
December 2015
2NS - Second Nature Security, Juho Nurminen
ERPScan, Alexander Polyakov, Mathieu Geli, Vahagn Vardanyan
Hyundai AutoEver Europe GmbH , Ashar Javed
NCC Group, Soroush Dalili
Onapsis, Alejandro Gabriel Burzyn, Juan Perez-Etchegoyen, Nahuel D. Sánchez, Sergio Abraham, Will Vandevanter
Portcullis Advisories , Sam Barltrop
Rui Silva
Trustwave , Martin Rakhmanov
ZDI Disclosures, Steven Seeley
November 2015
Blackroot Technologies , Pflash Punk , Virender C Nishad
ERPScan, Alexander Polyakov, Mathieu Geli
Hyundai AutoEver Europe GmbH , Ashar Javed
Onapsis , Fernando Russ, Pablo Artuso, Sergio Abraham
Virtual Forge, Agnes Six, Andreas Wiegenstein, Horst Bartmann, Thomas Kastner
FH Muenster, Damian Poddebniak, Prof. Dr. Sebastian Schinzel
October 2015
ERPScan , Mathieu GELI
Center for Computing Technologies at the Universität Bremen (TZI) , Karsten Sohr
Mehmet Nurcan
NCC Group , Soroush Dalili
Onapsis , Alejandro Gabriel Burzyn, Fernando Russ, Jordan Santarsieri, Juan Perez-Etchegoyen, Nahuel D. Sánchez, Pablo Artuso, Pabio Muller, Sergio Abraham
Pavan Paidy
ZDI Disclosures , Steven Seeley
September 2015
54H00 , Sumit Sahoo
ERPScan , Roman Bezhan, Vahagn Vardanyan
ERPSecurity , Joris van de Vis
Onapsis , Juan Perez-Etchegoyen, Nahuel D. Sánchez, Sergio Abraham
Syed Daniyal Bin Rashid
August 2015
2NS - Second Nature Security, Juho Nurminen
Bluebanyan Softech Pvt. Ltd, Mohit Sahu
ERPScan , Dmitry Chastuhin, Roman Bezhan, Vahagn Vardanyan
ERPSecurity , Joris van de Vis
Hyundai AutoEver Europe GmbH , Ashar Javed
Onapsis , Fernando Russ, Juan Perez-Etchegoyen, Nahuel D. Sánchez, Pablo Artuso, Sergio Abraham
July 2015
Amrita School of Arts and Sciences, Indrajith AN
ERPScan , Alexander Polyakov
ESNC , Ertunga Arsal
Hyundai AutoEver Europe GmbH , Ashar Javed
Onapsis , Juan Perez-Etchegoyen, Sergio Abraham
Subgraph , David Mckinney
Trustwave , Martin Rakhmanov
Werth IT, Thomas Werth
June 2015
Daimler TSS GmbH , Jürgen Bilberger ERPScan , Diana Grigoreva, Rustem Gazizov, Vahagn Vardanyan
Onapsis , Pablo Muller, Juan Perez-Etchegoyen, Sergio Abraham
Sogeti , Mark Deiss
May 2015
Alexander Klink
Core Security , Martin Gallo
ERPScan , Dmitry Chastuhin, Vahagn Vardanyan
Onapsis , Juan Perez-Etchegoyen, Nahuel D. Sánchez, Pablo Artuso, Will Vandevanter
Trustwave , Martin Rakhmanov
Virtual Forge , Andreas Wiegenstein
Xiting , Julius Bussche
April 2015
Onapsis, Fernando Russ
Martijn Sprengers
March 2015
ERPScan , Dmitry Chastuhin, Vahagn Vardanyan
Onapsis , Sergio Abraham
February 2015
ERPScan , Dmitry Chastuhin, Dmitry Evdokimov, George Nosenko, Vahagn Vardanyan
ING Services Polska, Lukasz Miedzinski
Onapsis , Nahuel D. Sánchez, Fernando Russ
Roberto Garcia Amoriz
Virtual Forge , Andreas Wiegenstein
January 2015
ERPScan , Nikolay Mescherin
ESNC , Ertunga Arsal
Gerasimos Panou
Onapsis , Sergio Abraham, Nahuel D. Sánchez, Fernando Russ
Rabiya Batool
Sense of Security , Fatih Ozavci
Trustwave SpiderLabs, Martin Rakhmanov
Virtual Forge , Andreas Wiegenstein
December 2014
ERPScan , George Nosenko, Vahagn Vardanyan
ESNC , Ertunga Arsal
Genral Motors, Markus Seibel
Sense of Security, Fatih Ozavci
Virtual Forge , Andreas Wiegenstein, Xu Jia
ZDI , John Leitch
November 2014
Emaze Networks S.p.A. , Enrico Milanese
ERPScan , Vahagn Vardanyan
ERPSecurity , Joris van de Vis
ESNC , Ertunga Arsal, Mert Suoglu
Kamil Sevi , Kamil Sevi
Portcullis Advisories , Tim Brown
Subgraph , David Mckinney
Virtual Forge , Andreas Wiegenstein, Xu Jia
October 2014
AKS IT Services , V. Lakshmi Kiran
Core Security , Martin Gallo
ERPScan , Alexey Tyurin, Dmitry Chastuhin, Igor Ilyin, Roman Bazhin, Vahagn Vardanyan
ERPSecurity , Joris van de Vis
Onapsis , Will Vandevanter
Subgraph , David Mckinney
Virtual Forge , Andreas Wiegenstein, Frederik Weidemann, Peter Werner, Xu Jia
September 2014
ERPSecurity , Joris van de Vis, SAP Security Note 2030775
ERPSecurity , Joris van de Vis, SAP Security Note 2043506
ERPSecurity , Joris van de Vis, SAP Security Note 1908631
ESNC , Ertunga Arsal, SAP Security Note 2015232
ESNC , Ertunga Arsal, SAP Security Note 1971397
Onapsis , Juan Pablo Perez Etchegoyen, Will Vandevanter, SAP Security Note 2039905
Onapsis , Pablo Muller, SAP Security Note 1979454
Sense of Security , Fatih Ozavci, SAP Security Note 2042074
Sense of Security , Fatih Ozavci, SAP Security Note 2039924
Sense of Security , Fatih Ozavci, SAP Security Note 2036547
August 2014
BDO, Buslov Dmitry, SAP Security Note 2028484
ERPSecurity,Joris van de Vis, SAP Security Note 1739143
ERPSecurity,Joris van de Vis, SAP Security Note 2017651
ERPScan , George Nosenko, SAP Security Note 2018221
ERPScan , George Nosenko, SAP Security Note 2025931
ESNC, Ertunga Arsal, SAP Security Note 1870485
NTT Com Security , Stephen Breen, SAP Security Note 2044175
NTT Com Security, Justin Kennedy, SAP Security Note 2053074
Trustwave , Martin Rakhmanov, SAP Security note 2044220
Virtual Forge , Andreas Wiegenstein & Xu Jia, SAP Security Note 1987773
Virtual Forge , Andreas Wiegenstein, SAP Security Note 1769064
Virtual Forge , Andreas Wiegenstein, SAP Security Note 1992114
ZDI , Aniway Anyway , SAP Security Note 1999142
July 2014
ERNW , Florian Grunow , SAP Security Note 1988956
ERPScan , Dmitry Chastuhin, SAP Security Note 2011169
Red-Team , Dave Hewson, SAP Security Note 1962104
ZDI Disclosures , Shanoon, SAP Security Note 2028891
NTT Com Security , Stephen Breen, SAP Security Note 2036562
June 2014
Compass Security , Stefan Horlacher, SAP Security Note 1908531
ERPScan , Dmitry Chastuhin, Vahagn Varda SAP Security Note 2014881
Onapsis , Will Vandevanter, SAP Security Note 2015446
Onapsis , Will Vandevanter, SAP Security Note 2001109
Onapsis , Will Vandevanter, SAP Security Note 2001106
Onapsis , Will Vandevanter, SAP Security Note 1998990
Onapsis , Will Vandevanter, SAP Security Note 1941562
Onapsis , Nahuel D. Sánchez, SAP Security Note 1967780
Subgraph , David Mckinney, SAP Security Note 1981048
Subgraph , David Mckinney, SAP Security Note 1971270
May 2014
Atos IT Gmbh ,Josè Manuel Lorenzo Lopez, SAP Security Note 1979438
ESNC , Ertunga Arsal, SAP Security Note 1889999
Onapsis, Will Vandevanter, SAP Security Note 2009696
Positive Technologies , Dmitry Gutsko, SAP Security Note 1997455
April 2014
Core Security , Martin Gallo, SAP Security Note 1986895
ERPSecurity , Joris van de Vis, SAP Security Note 1940405
ERPSecurity , Joris van de Vis, SAP Security Note 1971516
ESNC , Ertunga Arsal, SAP Security Note 1940405
Onapsis , Nahuel D. Sánchez, SAP Security Note 1974016
Onapsis , Will Vandevanter, SAP Security Note 1993349
Onapsis , Sergio Abraham, SAP Security Note 1929473
Onapsis , Nahuel D. Sánchez, SAP Security Note 1778940
Subgraph , David McKinney, SAP Security Note 1975842
University Bremen , Christian Liebig, SAP Security Note 1975842
University Bremen , Christian Liebig, SAP Security Note 2001778
Virtual Forge , Andreas Wiegenstein, SAP Security Note 1987413
Virtual Forge , Andreas Wiegenstein & Xu Jia, SAP Security Note 1985100
Virtual Forge , Andreas Wiegenstein, SAP Security Note 1983739
Virtual Forge , Frederik Weidemann, SAP Security Note 1878371
March 2014 Emaze Networks S.p.A. , Enrico Milanese, SAP Security Note 1946420
ERPSecurity , Joris van de Vis, SAP Security Note 1965610
ERPSecurity , Joris van de Vis, SAP Security Note 1884678
ESNC , Ertunga Arsal, SAP Security Note 1971238
Onapsis , Sergio Abraham, SAP Security Note 1964428
Onapsis , Sergio Abraham, Manuel Muradas, SAP Security Note 1963932
February 2014
ERPScan , Alexander Polyakov, SAP Security Note 1860923
ESNC , Ertunga Arsal, SAP Security Note 1945300
Onapsis , Sergio Abraham, SAP Security Note 1791081
Onapsis , Sergio Abraham, SAP Security Note 1768049
Onapsis , Sergio Abraham, SAP Security Note 1920323
Onapsis , Sergio Abraham, SAP Security Note 1915873
Onapsis , Sergio Abraham, SAP Security Note 1914777
Onapsis , Sergio Abraham, SAP Security Note 1911174
Onapsis , Sergio Abraham, SAP Security Note 1795463
Onapsis , Sergio Abraham, SAP Security Note 1789569
Onapsis , Sergio Abraham, SAP Security Note 1738965
Onapsis , Juan Pablo Perez Etchegoyen, Jordan Santarsieri, Pablo Muller, SAP Security Note 1939334
CyberSecurity Maldives , Shabnoon Khalid, SAP Security Note 1905408
January 2014
ERPScan , Neyolov Evgeny, SAP Security Note 1828885
ERPScan , Dmitry Chastuhin, SAP Security Note 1788080
Emaze Networks S.p.A ., Enrico Milanese , SAP Security Note 1932505
ERNW , Florian Grunow , SAP Security Note 1924853
ESNC , Ertunga Arsal, SAP Security Note 1886051
ESNC , Ertunga Arsal, SAP Security Note 1865109
Onapsis , Nahuel D. Sánchez, SAP Security Note 1894049
Onapsis , Juan Pablo Perez Etchegoyen, SAP Security Note, 1865109 Onapsis , Nahuel D. Sánchez, SAP Security Note 1918333
Onapsis , Nahuel D. Sánchez, SAP Security Note 1917381
Onapsis , Jordan Santarsieri, SAP Security Note 1922547
Onapsis , Jordan Santarsieri, SAP Security Note 1910914
Onapsis , Will Vandevanter , SAP Security Note 1931399
SecuRing , Krzysztof Kotowicz , SAP Security Note 1916560
Virtual Forge , Andreas Wiegenstein & Xu Jia, SAP Security Note 1949046
Virtual Forge , Andreas Wiegenstein & Xu Jia, SAP Security Note 1898046
Virtual Forge , Xu Jia, SAP Security Note 1884596
Virtual Forge , Andreas Wiegenstein, SAP Security Note 1956096