CVE-2025-42885

CVE-2025-42885 concerns SAP HANA 2.0 (hdbrss), where missing authentication lets an unauthenticated attacker call a remote-enabled function to view information. This is a network-based issue with low confidentiality impact and no impact on integrity or availability, and has a CVSS3.1 base score o...

CVE-2025-42884

CVE-2025-42884 affects SAP NetWeaver Enterprise Portal. The issue allows an unauthenticated attacker to inject JNDI environment properties or pass a URL during JNDI lookup, enabling access to an unintended JNDI provider and potentially leading to disclosure or modification of server information (...

CVE-2025-42884 JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

CVE-2025-42884 JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

CVE-2025-42883 Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench)

Migration Workbench DX Workbench in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low...

CVE-2025-42883 Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench)

Migration Workbench DX Workbench in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low...

CVE-2025-42882 Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

PT-2025-46229

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows affected versions not specified Description A highly privileged user on an affected client PC may be able to locally access sensitive information stored in process memory during runtime. This issue has a high impact on...

PT-2025-46226

Name of the Vulnerable Software and Affected Versions SAP HANA version 2.0 Description SAP HANA 2.0 hdbrss is affected by a missing authentication mechanism. This allows an unauthenticated attacker to call a remote-enabled function and view information. The issue has a low impact on...

PT-2025-46237

Name of the Vulnerable Software and Affected Versions SAP S4CORE affected versions not specified Description The software does not perform required authorization checks for authenticated users when managing journal entries, potentially allowing for privilege escalation. The issue has a low impact...

PT-2025-46227

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description A Reflected Cross-Site Scripting XSS issue exists in SAP Business Connector. An unauthenticated attacker can create a malicious link and distribute it. If a user accesses this...

PT-2025-46233

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description An unauthenticated attacker can exploit an Open Redirect flaw in SAP Business Connector by creating a malicious URL. If a user accesses this URL, they are redirected to a websi...

PT-2025-46235

Name of the Vulnerable Software and Affected Versions SAP HANA JDBC Client affected versions not specified Description The SAP HANA JDBC Client contains a flaw due to inadequate validation of connection property values. A locally authenticated, high-privilege user can provide specially crafted...

PT-2025-46239

Name of the Vulnerable Software and Affected Versions SAP S/4HANA affected versions not specified Description An unauthenticated attacker can create malicious links. Clicking these links redirects a victim to a page controlled by the attacker. This has a low impact on the confidentiality and...

PT-2025-46234

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description A Path Traversal issue exists in SAP Business Connector. An attacker with administrator privileges and adjacent access can read, write, overwrite, and delete arbitrary files on...

PT-2025-46224

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP affected versions not specified Description The Migration Workbench DX Workbench component does not initiate a malware scan when files are uploaded to the application server by a user with administrati...

PT-2025-46232

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description An OS Command Injection issue exists in SAP Business Connector. An authenticated attacker with administrative access and adjacent network access can upload specially crafted...

PT-2025-46238

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java affected versions not specified Description An information disclosure issue exists in SAP NetWeaver Application Server Java. An unauthenticated attacker can access internal metadata files through crafted...

PT-2025-46223

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP affected versions not specified Description An authenticated attacker with basic privileges could execute a function module in ABAP to retrieve restricted technical information from the system due to a...

PT-2025-46225

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject JNDI environment properties or provide a URL during JNDI lookup operations. This could allow access to an unintended JNDI...