CVE-2025-43003 Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on...

CVE-2025-43003 Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on...

CVE-2025-43002

CVE-2025-43002 affects SAP S4CORE via the OData meta-data property. The root cause is a missing authorization check, allowing an authenticated attacker to access restricted information. Impact is described as low confidentiality impact with no reported effects on integrity or availability; CVSS 3...

CVE-2025-43002 Missing Authorization check in SAP S4/HANA (OData meta-data property)

SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a low impact on confidentiality but integrity and availability of the application are not impacted...

CVE-2025-43002 Missing Authorization check in SAP S4/HANA (OData meta-data property)

SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a low impact on confidentiality but integrity and availability of the application are not impacted...

CVE-2025-43000

Summary: CVE-2025-43000 corresponds to an information-disclosure vulnerability in SAP Business Objects Business Intelligence Platform related to the Promotion Management Wizard (PMW). Based on connected records, the issue involves an access-control weakness that could allow an attacker to access ...

CVE-2025-43000 Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)

Under certain conditions Promotion Management Wizard PMW allows an attacker to access information which would otherwise be restricted.This has High impact on Confidentiality with Low impact on Integrity and Availability of the application...

CVE-2025-43000 Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)

Under certain conditions Promotion Management Wizard PMW allows an attacker to access information which would otherwise be restricted.This has High impact on Confidentiality with Low impact on Integrity and Availability of the application...

CVE-2025-42999

CVE-2025-42999 affects SAP NetWeaver Visual Composer Metadata Uploader. It is a deserialization vulnerability that can allow a privileged attacker to compromise confidentiality, integrity, and availability of the host system. Connected documents corroborate a broader context: CVE-2025-31324 (unre...

CVE-2025-42999 Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42999 Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42997 Information Disclosure vulnerability in SAP Gateway Client

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on...

CVE-2025-42997 Information Disclosure vulnerability in SAP Gateway Client

Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the possibility of influencing application behavior or performance through misuse of the exposed data, this may potentially lead to low impact on...

CVE-2025-42997

CVE-2025-42997 affects SAP Gateway Client. Description: information disclosure vulnerability where a high-privileged user can access restricted data beyond the application’s scope, caused by improper privilege management and data exposure that may yield low impact to confidentiality, integrity, a...

CVE-2025-31329 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as use...

CVE-2025-31329 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as use...

CVE-2025-31329

Summary: CVE-2025-31329 affects SAP NetWeaver (ABAP/ABAP Platform) with an information-disclosure via malicious instructions injected into user configuration settings. An administrator can craft instructions that, when loaded by the victim, exposes credentials and enables unauthorized access to l...

CVE-2025-30018

CVE-2025-30018 affects SAP SRM Live Auction Cockpit. An unauthenticated attacker can submit a crafted XML servlet request; parsed input enables access to sensitive files/data. Root cause: improper parsing of XML in the application servlet. Impact is confined to confidentiality (high); no demonstr...

CVE-2025-30018 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

The Live Auction Cockpit in SAP Supplier Relationship Management SRM allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the...

CVE-2025-30018 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

The Live Auction Cockpit in SAP Supplier Relationship Management SRM allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the...