CVE-2025-42938

CVE-2025-42938 describes a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform. An unauthenticated attacker can generate a malicious link that, when an authenticated user clicks it, is processed during page generation, resulting in malicious content execution within the vi...

CVE-2025-42938 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform

Due to a Cross-Site Scripting XSS vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation,...

CVE-2025-42927

CVE-2025-42927 affects SAP NetWeaver AS Java via the Adobe Document Service, where a vulnerable OpenSSL version is bundled. Root cause is outdated OpenSSL in the SAP NetWeaver AS Java platform; exploitation could enable a high-privilege user to access and modify system information. Impact is low ...

CVE-2025-42927 Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42927 Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42926 Missing Authentication check in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...

CVE-2025-42926 Missing Authentication check in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...

CVE-2025-42925 Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42925

The CVE-2025-42925 entry describes a vulnerability in SAP NetWeaver AS JAVA IIOP service caused by insufficient randomness when assigning Object Identifiers, enabling an authenticated lower-privileged actor to brute-force and predict identifiers to access limited system information. Affected comp...

CVE-2025-42925 Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42922

CVE-2025-42922 (SAP NetWeaver AS Java) : A flaw in SAP NetWeaver AS Java Deploy Web Service allows an attacker authenticated as a non-administrative user to upload an arbitrary file via an available service, and the executed file can lead to full compromise of confidentiality, integrity, and avai...

CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42918 Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)

SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability...

CVE-2025-42918 Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)

SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability...

CVE-2025-42918

The CVE-2025-42918 vulnerability affects SAP NetWeaver Application Server for ABAP. It arises from missing authorization checks that allow authenticated users with access to background processing to read profile parameters, leading to a low confidentiality impact with no effect on integrity or av...

CVE-2025-42911 Missing Authorization check in SAP NetWeaver (Service Data Download)

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

CVE-2025-42911

CVE-2025-42911 affects SAP NetWeaver (Service Data Download). An authenticated user can call a remote-enabled function module, potentially exposing information about the SAP system and operating system. The impact is described as low confidentiality impact, with no stated effects on integrity or ...

CVE-2025-42911 Missing Authorization check in SAP NetWeaver (Service Data Download)

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

SAP NetWeaver 安全漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A security vulnerability exists in SAP NetWeaver, which can be exploited by an attacker to potentially...