CVE-2025-31333

SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted...

CVE-2025-31333

The CVE-2025-31333 issue affects SAP S4CORE : an OData meta-data property vulnerability that could allow data tampering to externally modify an entity set, with low integrity impact and no impact to confidentiality or availability. Advisories note SAP has released patches to fix this and other SA...

Security Updates for Microsoft OneNote Products (April 2025)

The Microsoft OneNote Products are missing a security update. They are, therefore, affected by a security feature bypass vulnerability. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application. Note that...

CVE-2024-7035

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

GHSA-P5VX-9HJ8-CF4H Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

CVE-2024-7035

The CVE-2024-7035 issue affects open-webui/open-webui (v0.3.8). The underlying problem is CSRF because sensitive actions (delete/reset) are invoked via GET requests. Affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads, impactin...

CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

CVE-2025-25242

SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity...

CVE-2025-26661

Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...

Open Redirection

@sap/approuter is vulnerable to Open Redirection. The vulnerability is due to improper session handling due to an attacker injecting a malicious payload when trading an authorization code, allowing session hijacking and impacting the application's confidentiality and integrity...

CVE-2025-23191 Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP

Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the atom:link values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacke...

SAP Fiori security vulnerabilities

SAP Fiori, a user experience UX design system for SAP applications from SAP, Germany, provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, delivering a consistent, innovative experience for creators and users. A security...

CVE-2025-24966

reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the...

CVE-2022-41214

Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integri...

PT-2025-5609 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions up to and including 2.2.0 Description: The issue occurs due to improper validation or sanitization of user inputs in the "Add Target" functionality, allowing attackers to inject arbitrary HTML code. The injected HTML is...

CVE-2024-53683

A valid set of credentials in a .js file and a static token for communication were obtained from the decompiled IPA. An attacker could use the information to disrupt normal use of the application by changing the translation files and thus weaken the integrity of normal use...

CVE-2024-53683

CVE-2024-53683 affects the Ossur Mobile Logic Application. Hard-coded/valid credentials in a .js file and a static token found in the decompiled IPA could enable an attacker to disrupt normal use by altering translation files, compromising integrity. Public sources indicate vulnerable versions ex...

CVE-2024-47581

SAP HCM Approve Timesheets Version 4 contains a missing authorization check for an authenticated user, enabling escalation of privileges. The issue affects the application’s integrity at a low level; confidentiality and availability are not impacted. CVSSv3.1 base score shown as 4.3 (Medium) with...

CVE-2024-47581 Missing Authorization check in SAP HCM (Approve Timesheets version 4)

SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted...

CVE-2024-47581 Missing Authorization check in SAP HCM (Approve Timesheets version 4)

SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted...