CVE-2025-42909

CVE-2025-42909 (SAP Cloud Appliance Library Appliances) : A high-privilege attacker can exploit an insecure S/4HANA default profile setting in existing SAP CAL appliances to access other appliances. The impact is described as low for confidentiality with no impact on integrity or availability. Th...

EUVD-2025-34122

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

CVE-2025-42908 Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

CVE-2025-42908 Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

CVE-2025-42908

CVE-2025-42908 describes a CSRF vulnerability in SAP NetWeaver Application Server for ABAP where an authenticated attacker can initiate transactions via the session manager, bypassing the initial transaction screen and authorization check, potentially enabling actions that normally require specif...

CVE-2025-42906 Directory Traversal vulnerability in SAP Commerce Cloud

SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a lo...

CVE-2025-42903 User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management

A vulnerability in SAP Financial Service Claims Management RFC function ICLUSERGETNAMEANDADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability...

CVE-2025-42903 User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management

A vulnerability in SAP Financial Service Claims Management RFC function ICLUSERGETNAMEANDADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability...

CVE-2025-42903

CVE-2025-42903 pertains to SAP Financial Service Claims Management via the RFC function ICL_USER_GET_NAME_AND_ADDRESS. The issue allows user enumeration and potential disclosure of personal data due to response discrepancies, with low confidentiality impact and no impact to integrity or availabil...

CVE-2025-42902

The CVE-2025-42902 issue affects SAP NetWeaver AS ABAP and ABAP Platform. A memory corruption flaw allows an unauthenticated attacker to send a corrupted SAP Logon Ticket or SAP Assertion Ticket, causing a NULL pointer dereference and crashing the SAP work process. This yields impact on availabil...

CVE-2025-42901 Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)

SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability ...

CVE-2025-42901

CVE-2025-42901 affects SAP Application Server for ABAP (BAPI Explorer) where an authenticated attacker can store malicious JavaScript payloads that execute in the victim’s browser. Impact is described as low for confidentiality and integrity, with no availability impact. Root cause involves store...

SAP Commerce Cloud 路径遍历漏洞

SAP Commerce Cloud is a cloud-based e-commerce platform from Germany's SAP. It supports sales management, marketing management, order management and operations management. A path traversal vulnerability exists in SAP Commerce Cloud, which stems from the presence of a path traversal vulnerability...

PT-2025-41840

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP affected versions not specified Description A Cross-Site Request Forgery CSRF issue exists in SAP NetWeaver Application Server for ABAP. An authenticated attacker may be able to initiate transactions...

PT-2025-41843

Name of the Vulnerable Software and Affected Versions SAP Print Service SAPSprint affected versions not specified Description SAP Print Service SAPSprint does not adequately validate path information provided by users. This allows an unauthenticated attacker to traverse directories and overwrite...

PT-2025-41839

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description SAP Commerce Cloud contains a path traversal issue that could allow users to access web applications, such as the Administration Console, from locations where it is not explicitly...

SAP Supplier Relationship Management 代码问题漏洞

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP, Germany. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functionality such as invoicing. A code issue vulnerability exists in SA...

SAP NetWeaver AS ABAP Business Server和SAP ABAP Platform 代码问题漏洞

SAP NetWeaver AS ABAP Business Server and SAP ABAP Platform are both products of SAP, Germany.SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming.SAP SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: open-vm-tools security update

An update for open-vm-tools is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...