CVE-2025-42952: Missing Authorization

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by triggering short dumps on login. Thi...

CVE-2025-42954: Loop with Unreachable Exit Condition

SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on...

SAP NetWeaver Application Server ABAP和SAP ABAP Platform 跨站脚本漏洞

SAP ABAP Platform and SAP NetWeaver Application Server ABAP are both products of SAP, Germany.SAP ABAP Platform is an ABAP-based SAP solution.SAP NetWeaver Application Server SAP NetWeaver Application Server ABAP is a platform for running and developing applications based on the ABAP language. A...

PT-2025-28280 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application server for ABAP affected versions not specified Description: The issue is caused by a missing authorization check, allowing an authenticated user with high privileges to exploit insufficient validation of user...

PT-2025-28291 · Sap · Sap Data Services Management Console

Name of the Vulnerable Software and Affected Versions: SAP Data Services Management Console affected versions not specified Description: The issue is related to a Cross-Site Scripting vulnerability in the search functionality associated with DQ job status reports. An authenticated attacker could...

PT-2025-28274 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description: The issue allows an attacker with basic user privileges to inject malicious code into specific input fields, potentially leading ...

SAP NetWeaver 安全漏洞

SAP NetWeaver is a set of integrated service-oriented application platforms from SAP, Germany. The platform primarily provides a development and runtime environment for SAP applications. A security vulnerability exists in SAP NetWeaver that originates from an authenticated, non-administrative use...

SAP BusinessObjects Business Intelligence Platform 安全漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

PT-2025-28286 · Sap · Sap S/4Hana +1

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA and SAP SCM versions S4CORE 102-108 Description: SAP S/4HANA and SAP SCM Characteristic Propagation contains a remote code execution issue. An attacker with user-level or high privileges can create a new report containing maliciou...

CVE-2025-42967: Improper Control of Generation of Code

SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high impact on confidentiality, integrity, an...

PT-2025-28299

Name of the Vulnerable Software and Affected Versions: SAP BASIS affected versions not specified Description: The issue is caused by a missing authorization check in an obsolete RFC enabled function module. This allows an authenticated low-privileged attacker to call a Remote Function Call RFC,...

Malicious code in sap.ushell.components.tiles.utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c610571a96a422fc7b583bd55f4996dc51b894fe4d4a8cf415f7ebf1be5caf7 Any computer that has this package installed or running should be considered...

MAL-2025-5458 Malicious code in sap.ushell.components.tiles.utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c610571a96a422fc7b583bd55f4996dc51b894fe4d4a8cf415f7ebf1be5caf7 Any computer that has this package installed or running should be considered...

Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure

Cybersecurity researchers have detailed two now-patched security flaws in SAP Graphical User Interface GUI for Windows and Java that, if successfully exploited, could have enabled attackers to access sensitive information under certain conditions. The vulnerabilities, tracked as CVE-2025-0055 and...

Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure

Cybersecurity researchers have detailed two now-patched security flaws in SAP Graphical User Interface GUI for Windows and Java that, if successfully exploited, could have enabled attackers to access sensitive information under certain conditions. The vulnerabilities, tracked as CVE-2025-0055 and...

The vulnerability of the ABAP Keyword Documentation component of the SAP NetWeaver software integration platform allows attackers to perform cross-site scripting attacks.

The vulnerability of the ABAP Keyword Documentation component in the SAP NetWeaver software integration platform is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Important: Red Hat Security Advisory: libblockdev security update

An update for libblockdev is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: libblockdev security update

An update for libblockdev is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SAP Business One Integration Framework Access Control Error Vulnerability

SAP Business One Integration Framework is an integration solution for growing organizations. An access control error vulnerability exists in SAP Business One Integration Framework, which stems from insufficient security settings checking, and can be exploited by an attacker to cause a bypass 403...

SAP Manage Processing Rules Authorization Issues Vulnerability

SAP is enterprise applications, enterprise resource management applications, supply chain management applications, procurement applications, travel and expense management software. An authorization issue vulnerability exists in SAP Manage Processing Rules, which stems from insufficient...