CVE-2025-42981 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP

Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting the...

CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42980

CVE-2025-42980 affects SAP NetWeaver Enterprise Portal Federated Portal Network. The initial and linked sources describe an insecure deserialization vulnerability where a privileged user can upload untrusted or malicious content, which, when deserialized, can compromise confidentiality, integrity...

CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42979 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive o...

CVE-2025-42979

The CVE-2025-42979 entry concerns GuiXT, which is integrated with SAP GUI for Windows. The vulnerability stems from using obfuscation algorithms instead of secure symmetric ciphers to store RFC user credentials on the client PC, residing in the Windows user registry hive. This leads to a confiden...

CVE-2025-42979 Insecure Key & Secret Management vulnerability in SAP GUI for Windows

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive o...

CVE-2025-42978

The CVE-2025-42978 entry concerns SAP NetWeaver Application Server Java and a flaw in outbound TLS connections: the component may not reliably compare the remote server’s hostname with the wildcard in the server certificate, potentially causing connections to a malicious TLS server and leading to...

CVE-2025-42978 Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound...

CVE-2025-42978 Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound...

CVE-2025-42974 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability...

CVE-2025-42974 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability...

CVE-2025-42973

CVE-2025-42973 affects the SAP Data Services Management Console. A cross-site scripting (XSS) vulnerability exists in the search functionality for DQ job status reports. An authenticated attacker can intercept requests to inject malicious script, which executes when the affected page loads. This ...

CVE-2025-42973 Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

CVE-2025-42973 Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

CVE-2025-42969 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

CVE-2025-42969 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

CVE-2025-42969

CVE-2025-42969 describes a cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform. An unauthenticated attacker can inject a malicious script into a dynamically crafted URL, which, when a user follows, executes in the browser and may access or modify se...

CVE-2025-42968 Missing Authorization check in SAP NetWeaver (RFC enabled function module)

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on...

CVE-2025-42968

CVE-2025-42968 affects SAP NetWeaver. An authenticated non-administrative user can invoke a remote-enabled function module (RFC) and access information about the SAP system and OS that is not sensitive, with low impact on confidentiality and no impact on integrity or availability. The root cause ...