17625 matches found
CVE-2025-31324 Missing Authorization check in SAP NetWeaver (Visual Composer development server)
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...
CVE-2025-31324
CVE-2025-31324 affects SAP NetWeaver Visual Composer Metadata Uploader (VCFRAMEWORK). Unauthenticated uploads to /developmentserver/metadatauploader allow remote code execution with SAP service user privileges (RCE in VCFRAMEWORK) and can compromise confidentiality, integrity, and availability. C...
CVE-2025-31324
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...
The vulnerability of the SAP Solution Manager platform, related to deficiencies in the authentication process, allows a perpetrator to compromise the confidentiality of protected information.
The vulnerability of the SAP Solution Manager platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to compromise the confidentiality of the protected information...
The vulnerability of the SAP NetWeaver software integration platform, related to incorrect authorization, allows a perpetrator to execute arbitrary code.
The vulnerability of the SAP NetWeaver software integration platform is related to incorrect authorization. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2025-31328
SAP Learning Solution is vulnerable to Cross-Site Request Forgery CSRF, allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the...
CVE-2025-31327
SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability are not impacted...
CVE-2025-31328 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)
SAP Learning Solution is vulnerable to Cross-Site Request Forgery CSRF, allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the...
CVE-2025-31328 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)
SAP Learning Solution is vulnerable to Cross-Site Request Forgery CSRF, allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the...
CVE-2025-31328
CVE-2025-31328 – SAP Learning Solution (CSRF) : The SAP Learning Solution is vulnerable to Cross-Site Request Forgery, allowing authenticated users to be tricked into unintended requests. A GET-based OData function is noted to violate expected behavior, with impact described as affecting confiden...
CVE-2025-31327 OData meta-data property entity tampering in SAP Field Logistics
SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability are not impacted...
CVE-2025-31327
CVE-2025-31327 affects the SAP Field Logistics Manage Logistics component’s OData metadata property. The vulnerability permits data tampering where an attacker could externally modify certain fields, yielding a low impact on integrity; confidentiality and availability remain unaffected. CVSS v3.1...
CVE-2025-31327 OData meta-data property entity tampering in SAP Field Logistics
SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability are not impacted...
SAP Field Logistics Manage Logistics 安全漏洞
SAP Field Logistics Manage Logistics is a solution module from SAP that is used to coordinate "field material supply". A security vulnerability exists in SAP Field Logistics Manage Logistics that originates from data tampering and could result in a low impact on application integrity...
SAP Learning Solution 跨站请求伪造漏洞
SAP Learning Solution is an enterprise-wide learning management system from SAP. SAP Learning Solution suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could explo...
PT-2025-17589 · Sap · Sap Learning Solution
Name of the Vulnerable Software and Affected Versions: SAP Learning Solution affected versions not specified Description: The issue allows an attacker to trick an authenticated user into sending unintended requests to the server through Cross-Site Request Forgery CSRF. A GET-based OData function ...
VulnCheck KEV: CVE-2017-9844
SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer...
PT-2025-17588 · Sap · Sap Field Logistics Manage Logistics
Name of the Vulnerable Software and Affected Versions: SAP Field Logistics Manage Logistics affected versions not specified Description: The SAP Field Logistics Manage Logistics application's OData meta-data property is susceptible to data tampering. This allows an attacker to externally modify...
PT-2025-17845
Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions prior to September 2025 Description A critical remote code execution issue exists in the SAP NetWeaver Development Server, specifically within the Visual Composer tool's Metadata Uploader function. The flaw is caused by...
