CVE-2025-43010 Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

SAP S/4HANA Cloud Private Edition or on Premise SCM Master Data Layer MDL allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation an...

CVE-2025-43010 Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

SAP S/4HANA Cloud Private Edition or on Premise SCM Master Data Layer MDL allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation an...

CVE-2025-43008 Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. There is no impact on integrity and availability...

CVE-2025-43000 Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)

Under certain conditions Promotion Management Wizard PMW allows an attacker to access information which would otherwise be restricted.This has High impact on Confidentiality with Low impact on Integrity and Availability of the application...

Medium: edk2

Issue Overview: EDK2 contains a vulnerability in the HashPeImageByType. A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. CVE-2024-38797...

Siemens SIMATIC IPC RS-828A

SUMMARY SIMATIC IPC RS-828A is affected by an authentication bypass vulnerability in the Redfish interface of its Baseboard Management Controller BMC that could allow an attacker to gain unauthorized access and compromise confidentiality, integrity and availability of the BMC and thus the entire...

Photon OS 4.0: Apache PHSA-2025-4.0-0777

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0777. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2025-20822 · Sap · Sap S/4Hana Cloud Private Edition +1

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA Cloud Private Edition affected versions not specified Description: The issue allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs,...

Amazon Linux 2 : edk2 (ALAS-2025-2852)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2852 advisory. EDK2 contains a vulnerability in the HashPeImageByType. A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this...

OPENSUSE-SU-2025:15084-1 cpp-httplib-devel-0.20.1-1.1 on GA media

These are all security issues fixed in the cpp-httplib-devel-0.20.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system. Recent assessments: Assessed Attacker...

OPENSUSE-SU-2025:15081-1 libxmp-devel-4.6.3-1.1 on GA media

These are all security issues fixed in the libxmp-devel-4.6.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15077-1 java-11-openj9-11.0.27.0-1.1 on GA media

These are all security issues fixed in the java-11-openj9-11.0.27.0-1.1 package on the GA media of openSUSE Tumbleweed...

Mageia: Security Advisory (MGASA-2025-0152)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2025:15080-1 java-21-openj9-21.0.7.0-1.1 on GA media

These are all security issues fixed in the java-21-openj9-21.0.7.0-1.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the Linux operating system’s kernel, related to the use of memory after it is freed, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

OPENSUSE-SU-2025:15073-1 chromedriver-136.0.7103.92-1.1 on GA media

These are all security issues fixed in the chromedriver-136.0.7103.92-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-22221

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12 Description A vulnerability in the Linux kernel has been resolved. The issue occurs in the memblock double array function when increasing the array size and the slab is not yet available. A call to memblock...

Vulnerability of the mtk_iommu_hw_init() function in the drivers/iommu/mtk_iommu.c module – This driver for Linux’s IOMMU kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the mtkiommuhwinit function in the drivers/iommu/mtkiommu.c module – Linux’s IOMMU kernel support driver is vulnerable due to the use of the NULL pointer assignment. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the org.xwiki.platform:xwiki-platform-security-requiredrights-default component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the org.xwiki.platform:xwiki-platform-security-requiredrights-default component of the XWiki Platform relates to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability could allow an attacker to influence the confidentiality, integrity, and...