CVE-2025-42925

The CVE-2025-42925 entry describes a vulnerability in SAP NetWeaver AS JAVA IIOP service caused by insufficient randomness when assigning Object Identifiers, enabling an authenticated lower-privileged actor to brute-force and predict identifiers to access limited system information. Affected comp...

CVE-2025-42925 Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42925 Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42923

CVE-2025-42923 is a cross-site request forgery (CSRF) vulnerability in SAP Fiori App Manage Work Center Groups. An authenticated user could be tricked into sending unintended requests to the web server. The CVSS 3.1 vector indicates Network attack, Low attack complexity, Privileges Required: Low,...

CVE-2025-42923 Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)

Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application...

CVE-2025-42922

CVE-2025-42922 (SAP NetWeaver AS Java) : A flaw in SAP NetWeaver AS Java Deploy Web Service allows an attacker authenticated as a non-administrative user to upload an arbitrary file via an available service, and the executed file can lead to full compromise of confidentiality, integrity, and avai...

CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42920 Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management

Due to a Cross-Site Scripting XSS vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation,...

CVE-2025-42918 Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)

SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability...

CVE-2025-42918 Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)

SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability...

CVE-2025-42916 Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on...

CVE-2025-42916

CVE-2025-42916 concerns a missing input validation in SAP S/4HANA/ABAP reports that could allow an attacker with high privileges to delete contents of arbitrary database tables not protected by an authorization group. The impact is high on integrity and availability with no confidentiality impact...

CVE-2025-42914

CVE-2025-42914 affects the SAP HCM My Timesheet Fiori 2.0 application. The root cause is missing authorization checks, enabling an authenticated attacker with in-depth system knowledge to escalate privileges and perform restricted activities. Impact is described as low for integrity; confidential...

CVE-2025-42913

CVE-2025-42913 affects SAP HCM My Timesheet Fiori 2.0. The issue is missing authorization checks allowing an authenticated attacker with in-depth system knowledge to escalate privileges and perform restricted activities, with low impact to integrity; confidentiality and availability are unaffecte...

CVE-2025-42912 Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)

SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availability remain unaffected...

CVE-2025-42911 Missing Authorization check in SAP NetWeaver (Service Data Download)

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

CVE-2025-42911 Missing Authorization check in SAP NetWeaver (Service Data Download)

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

SAP NetWeaver 代码问题漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A deserialization vulnerability exists in SAP NetWeaver, which arises from unsafe deserialization of...

PT-2025-36544

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, potentially granting access to information about the SAP system and operatin...