CVE-2025-42996 Multiple vulnerabilities in SAP MDM Server

SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing...

CVE-2025-42996

CVE-2025-42996 affects SAP Master Data Management Server. The issue is a flaw in session control that lets an attacker gain control of existing client sessions and perform functions without re-authentication, potentially accessing or modifying non‑sensitive data or consuming resources and degradi...

CVE-2025-42995 Multiple vulnerabilities in SAP MDM Server

SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the...

CVE-2025-42995

CVE-2025-42995: SAP MDM Server is affected by a vulnerability in the Read function where specially crafted packets can trigger a memory read access violation, causing the server process to fail and exit. The documented impact is high availability disruption with no confidentiality or integrity im...

CVE-2025-42995 Multiple vulnerabilities in SAP MDM Server

SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the...

CVE-2025-42994 Multiple vulnerabilities in SAP MDM Server

SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the...

CVE-2025-42994

The CVE-2025-42994 entry concerns SAP MDM Server where the ReadString function can be triggered by specially crafted packets to cause a memory read access violation, leading to a server crash and high availability impact. The initial description assigns a CVSS v3.1 base score of 7.5 (HIGH) with N...

CVE-2025-42994 Multiple vulnerabilities in SAP MDM Server

SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the...

CVE-2025-42993

Summary: CVE-2025-42993 affects SAP S/4HANA (Enterprise Event Enablement). A missing authorization check allows an attacker with access to Inbound Binding Configuration to create an RFC destination and assign a high-privilege user, enabling code execution under that user’s privileges. Impact is l...

CVE-2025-42993 Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Due to a missing authorization check vulnerability in SAP S/4HANA Enterprise Event Enablement, an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC...

CVE-2025-42993 Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Due to a missing authorization check vulnerability in SAP S/4HANA Enterprise Event Enablement, an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC...

CVE-2025-42991 Missing Authorization check in SAP S/4HANA (Bank Account Application)

SAP S/4HANA Bank Account Application does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the...

CVE-2025-42991

SAP S/4HANA Bank Account Application is affected by a Missing Authorization check vulnerability. An authenticated "+approver" user can delete attachments from another user’s bank account application, causing low integrity impact (no confidentiality or availability impact). Root cause identified a...

CVE-2025-42991 Missing Authorization check in SAP S/4HANA (Bank Account Application)

SAP S/4HANA Bank Account Application does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the...

CVE-2025-42989

Summary (CVE-2025-42989) : SAP NetWeaver Application Server for ABAP (RFC inbound processing) may lack necessary authorization checks for authenticated users, enabling privilege escalation. Reported impact includes potential disruption to integrity and availability. The initial documents do not s...

CVE-2025-42989 Missing Authorization check in SAP NetWeaver Application Server for ABAP

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application...

CVE-2025-42989 Missing Authorization check in SAP NetWeaver Application Server for ABAP

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application...

CVE-2025-42988

CVE-2025-42988 affects SAP Business Objects Business Intelligence Platform. The issue allows an unauthenticated attacker to enumerate HTTP endpoints on the internal network by crafting specific HTTP requests, enabling information disclosure that could facilitate SSRF. The provided documents descr...

CVE-2025-42988 Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform

Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no...

CVE-2025-42988 Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform

Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no...