CVE-2025-42981

CVE-2025-42981 concerns SAP NetWeaver Application Server ABAP. The provided details confirm an open-redirect vulnerability that allows an unauthenticated attacker to craft a URL embedding malicious script. When a victim clicks the link, the script runs in the browser and can redirect to an attack...

CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42980

CVE-2025-42980 affects SAP NetWeaver Enterprise Portal Federated Portal Network. The initial and linked sources describe an insecure deserialization vulnerability where a privileged user can upload untrusted or malicious content, which, when deserialized, can compromise confidentiality, integrity...

CVE-2025-42978

The CVE-2025-42978 entry concerns SAP NetWeaver Application Server Java and a flaw in outbound TLS connections: the component may not reliably compare the remote server’s hostname with the wildcard in the server certificate, potentially causing connections to a malicious TLS server and leading to...

CVE-2025-42978 Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound...

CVE-2025-42978 Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound...

CVE-2025-42974 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability...

CVE-2025-42974 Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable access to information normally restricted, resulting in low impact on confidentiality. There is no impact on integrity or availability...

CVE-2025-42969 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

CVE-2025-42969 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

CVE-2025-42969

CVE-2025-42969 describes a cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform. An unauthenticated attacker can inject a malicious script into a dynamically crafted URL, which, when a user follows, executes in the browser and may access or modify se...

CVE-2025-42968 Missing Authorization check in SAP NetWeaver (RFC enabled function module)

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on...

CVE-2025-42968 Missing Authorization check in SAP NetWeaver (RFC enabled function module)

SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information about the SAP system and OS without requiring any specific knowledge or controlled conditions. This leads to a low impact on...

CVE-2025-42968

CVE-2025-42968 affects SAP NetWeaver. An authenticated non-administrative user can invoke a remote-enabled function module (RFC) and access information about the SAP system and OS that is not sensitive, with low impact on confidentiality and no impact on integrity or availability. The root cause ...

CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-42966

CVE-2025-42966 affects SAP NetWeaver XML Data Archiving Service. The vulnerability is an insecure Java deserialization flaw exploitable by an authenticated attacker with administrative privileges via a crafted serialized Java object. This can impact confidentiality, integrity, and availability of...

CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-42964

CVE-2025-42964 affects SAP NetWeaver Enterprise Portal Administration. A privileged user can upload untrusted or malicious content that is deserialized, potentially compromising confidentiality, integrity, and availability of the host system. Public documentation consistently identifies insecure ...

CVE-2025-42964 Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration

SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...