CVE-2025-42938 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform

Due to a Cross-Site Scripting XSS vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation,...

CVE-2025-42933 Insecure Storage of Sensitive Information in SAP Business One (SLD)

When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidentiality, integrity, and availability of t...

CVE-2025-42933

CVE-2025-42933 affects SAP Business One through the SLD backend service, where a flaw in enforcing encryption of certain APIs exposes sensitive credentials in HTTP response bodies. The issue impacts confidentiality, integrity, and availability. CVSS 3.1 base score 8.8 (Network, Low attack complex...

CVE-2025-42930 Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there...

CVE-2025-42930 Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation

SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there...

CVE-2025-42929

CVE-2025-42929 describes a missing input validation vulnerability in SAP Landscape Transformation Replication Server (ABAP reports). The root cause is insufficient input validation in a component handling ABAP reports, allowing a high-privilege attacker to delete the content of arbitrary database...

CVE-2025-42929 Missing input validation vulnerability in SAP Landscape Transformation Replication Server

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database...

CVE-2025-42927

CVE-2025-42927 affects SAP NetWeaver AS Java via the Adobe Document Service, where a vulnerable OpenSSL version is bundled. Root cause is outdated OpenSSL in the SAP NetWeaver AS Java platform; exploitation could enable a high-privilege user to access and modify system information. Impact is low ...

CVE-2025-42927 Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42927 Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability ha...

CVE-2025-42926 Missing Authentication check in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...

CVE-2025-42926 Missing Authentication check in SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...

CVE-2025-42925 Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42925 Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42925

The CVE-2025-42925 entry describes a vulnerability in SAP NetWeaver AS JAVA IIOP service caused by insufficient randomness when assigning Object Identifiers, enabling an authenticated lower-privileged actor to brute-force and predict identifiers to access limited system information. Affected comp...

CVE-2025-42923 Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)

Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application...

CVE-2025-42923

CVE-2025-42923 is a cross-site request forgery (CSRF) vulnerability in SAP Fiori App Manage Work Center Groups. An authenticated user could be tricked into sending unintended requests to the web server. The CVSS 3.1 vector indicates Network attack, Low attack complexity, Privileges Required: Low,...

CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system...

CVE-2025-42922

CVE-2025-42922 (SAP NetWeaver AS Java) : A flaw in SAP NetWeaver AS Java Deploy Web Service allows an attacker authenticated as a non-administrative user to upload an arbitrary file via an available service, and the executed file can lead to full compromise of confidentiality, integrity, and avai...