CVE-2025-23191 Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP

Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the atom:link values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacke...

CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-23189 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability...

CVE-2025-23189 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability...

CVE-2025-23187 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability...

CVE-2025-23187

CVE-2025-23187 affects SAP NetWeaver and ABAP Platform (RFC-enabled function module in SDCCN). A missing authorization check allows unauthenticated attackers to generate technical metadata, causing low integrity impact and no confidentiality/availability impact. Public details come from NVD/SA so...

CVE-2025-23187 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability...

CVE-2025-0064

CVE-2025-0064 concerns the SAP BusinessObjects BI Platform, specifically the Central Management Console. Under certain conditions, an attacker with admin rights can generate or retrieve a secret passphrase, enabling impersonation of any user in the system. Reported impact targets confidentiality ...

CVE-2025-0064 Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)

Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiali...

CVE-2025-0064 Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)

Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiali...

CVE-2025-0054 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web...

CVE-2025-0054

CVE-2025-0054 describes a stored cross-site scripting vulnerability in SAP NetWeaver Application Server Java caused by insufficient input handling. Attackers with basic user privileges can store a JavaScript payload on the server, which may be executed in other users’ browsers when affected pages...

CVE-2025-0054 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web...

PT-2025-6128 · Sap · Sap Hana Xs Advanced Model

Name of the Vulnerable Software and Affected Versions: SAP HANA extended application services, advanced model SAP HANA XS advanced model affected versions not specified Description: The User Account and Authentication service UAA for SAP HANA extended application services, advanced model allows a...

PT-2025-6130 · Sap · Sap Gui For Windows

Name of the Vulnerable Software and Affected Versions: SAP GUI for Windows versions prior to the fixed version Description: The SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program, allowing an unauthenticated attacker to access information within...

PT-2025-6133 · Sap · Sap Commerce

Name of the Vulnerable Software and Affected Versions: SAP Commerce affected versions not specified Description: The issue is related to SAP Commerce setting certain cookies with the SameSite attribute configured to None by default. This includes authentication cookies used in SAP Commerce...

PT-2025-6131 · Sap · Sap Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP ABAP Platform ABAP Build Framework versions prior to the fixed version Description: The issue allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the...

PT-2025-6126 · Sap · Sap Netweaver Abap Server

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Server ABAP versions prior to the fixed version Description: The issue allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user,...

SAP HANA 输入验证错误漏洞

SAP HANA is a high-performance real-time data analytics platform from SAP, a German company. The platform provides data query functionality to support users to query and analyze real-time business data. An input validation error vulnerability exists in SAP HANA that stems from insufficient redire...