📄 Helmholz Industrial Router REX100 / MBConnectline mbNET.mini Command Injection / DoS

Helmholz Industrial Router REX100 versions prior to 2.3.3 and MBConnectline mbNET.mini versions prior to 2.3.3 suffer from buffer overflow, command injection, denial of service, cross site scripting, and remote SQL injection vulnerabilities. St. Pölten UAS 20250721-0...

PT-2025-28300 · Sap · Sapcar

Name of the Vulnerable Software and Affected Versions: SAPCAR affected versions not specified Description: The issue allows an attacker with high privileges to create a malicious SAR archive in SAPCAR, potentially enabling them to exploit critical files and directory permissions without breaking...

CVE-2025-42982

CVE-2025-42982 affects SAP GRC. The vulnerability allows a non-administrative user to access and initiate a transaction that could modify or control transmitted system credentials, with high impact to confidentiality, integrity, and availability. Root cause is insufficient authorization controls ...

CVE-2025-42977

CVE-2025-42977 concerns SAP NetWeaver Visual Composer and is a directory-traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. The affected component is the SAP NetWeaver Visual Composer environment; the underlying issue is improper input pat...

CVE-2025-27703

CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to a specific subset of privileged features in the console can elevate their permissions to access additional features in the...

CVE-2025-27702

CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly modify settings. The attack complexi...

CVE-2025-27703 Privilege escalation in the management console of Absolute Secure Access prior to version 13.54

CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to a specific subset of privileged features in the console can elevate their permissions to access additional features in the...

CVE-2024-37349

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the victim administrator edits the same management...

CVE-2023-24530

SAP BusinessObjects Business Intelligence Platform CMC - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that may completely compromise the...

CVE-2021-21446

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service...

📄 HP Sure Access Enterprise / Sure Click Enterprise Missing Authentication

SEC Consult conducted penetration tests on Sure Access in 2022 and on Sure Click in 2023 and established a contact with HP afterwards. After several rounds of emails and meetings with the product development team, the scope and limitations of Sure Access and Sure Click were made clear. This...

TIBCO Security Advisory: May 13, 2025 - TIBCO ActiveMatrix BusinessWorks - CVE-2025-3751

TIBCO ActiveMatrix BusinessWorks SQL Injection Vulnerability Original release date: May 13, 2025 Last revised: --- CVE-2025-3751 Source: TIBCO Software Inc. Products Affected TIBCO ActiveMatrix BusinessWorks version 5.16.1 Component Affected UDDI Plugin “TIBCO Administrator” Description The...

TIBCO Security Advisory: May 13, 2025 - TIBCO BPM Enterprise - CVE-2025-2261

TIBCO BPM Enterprise XSS Vulnerability Original release date: May 13, 2025 Last revised: --- CVE-2025-2261 Source: TIBCO Software Inc. Products Affected TIBCO BPM Enterprise Component Affected TIBCO ActiveMatrix Administrator Description Stored XSS occurs when a web application gathers input from...

CVE-2025-30018

The Live Auction Cockpit in SAP Supplier Relationship Management SRM allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the...

CVE-2025-43011 Missing Authorization Check in SAP Landscape Transformation (PCL Basis)

Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to access restricted functionalities or data. This can lead to a high impact on confidentiality with no impact on the integrity or availabili...

CVE-2025-43003 Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field. On performing this step the attacker could gain access to highly sensitive information. This could cause a high impact on...

CVE-2025-30018 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

The Live Auction Cockpit in SAP Supplier Relationship Management SRM allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the...

PT-2025-20809 · Sap · Sap Srm

Name of the Vulnerable Software and Affected Versions: SAP Supplier Relationship Management SRM affected versions not specified Description: The issue allows an unauthenticated attacker to submit a crafted XML file, enabling access to sensitive files and data. This has a high impact on the...

CVE-2025-20197

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. This vulnerability is due to insufficient input validation when processing specific...

CVE-2025-20200

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device. This vulnerability is due to insufficient input validation when processing specific...